A ClickFix campaign that Huntress exposed in late September 2026 starts on a domain nobody would think to flag, chatgpt.com itself. There, an attacker-built Custom GPT called “Plus 5.6” answers every prompt with a fake outage notice and a Google Sites link, where a fake Cloudflare check talks the visitor into pasting a command that installs a remote access trojan. If your users reach ChatGPT from Windows machines that run PowerShell unrestricted, you are in scope, and the two rules below cover stages this operator has not managed to rotate.
Picture the person on the other end. They searched for “chatgpt”, clicked the top sponsored result, and checked the address bar the way every awareness course tells them to. It said chatgpt.com, because it was, and that is the part of this campaign we think defenders should sit with.
What happened
The Custom GPT is new, but the playbook is not. Huntress has already tracked Google ads promoting shared ChatGPT and Grok conversations that pushed macOS malware in December 2025, and malicious Claude Artifacts carried the same kind of lure in July 2026.
- Late September 2026: Victims reached the Plus 5.6 GPT through sponsored Google results for searches like “chatgpt”.
- September 25, 2026: OpenAI took down the first GPT after Huntress reported it.
- September 27, 2026: Huntress found a second GPT from the same campaign, delivering a reworked chain.
- September 29, 2026: Coverage began, and Help Net Security found the second GPT still online but no longer pointing at the lure.
- December 11, 2026: OpenAI plans to retire Custom GPTs.
Read the scale carefully, because some coverage did not. Huntress says its SOC responded to at least 40 incidents stemming from the Google Sites domain and confirmed that two came through a Custom GPT. The Google Sites page is the funnel and the GPT is one door into it, which matters when you decide where detections go.
How the ClickFix chain works
Once the searcher lands on the GPT, every prompt returns the same “Service Availability Notice”. It offered an upgrade or a backup domain, and nudged toward the second with “We recommend using the backup domain if you need immediate access”. The Google Sites page then poses as a Cloudflare CAPTCHA and, in Huntress’s words, tells users to paste a command into their Terminal. That PowerShell names its server as a decimal IP address rather than a dotted one, which Windows accepts but some URL filters may not recognize, and it silently installs an MSI.
From there the operator spends eight stages reaching the payload. The first-wave MSI, ISOSimple.msi, uses a signed Canon executable, COTFileReadApp.exe, to sideload a tampered copy of Canon’s own ceiinfolog.dll. That DLL loads an unsigned rdCore.dll, which pulls an encrypted loader out of Common.Integrator.Preview.wav, a file that starts as real audio and turns into payload bytes halfway through. The loader bypasses AMSI, unhooks ntdll.dll and runs anti-VM checks before unpacking the RAT from monitor.raw, which Huntress calls basically a homemade, encrypted zip file.
What arrives is a full remote access kit, with remote desktop, screen, webcam, microphone and system-audio capture, file-content search, and follow-on EXE, DLL, MSI and script payloads. It resolves its C2 server through DNS-over-HTTPS to Cloudflare, Google and Quad9, so those lookups never reach your local DNS logs. Persistence is a Run value and a scheduled task, both named “Canon Configuration Reader”. In at least one incident Microsoft Defender quarantined the MSI after those two were already in place, and the attack simply continued.
The second GPT came with a second build. It swaps the Canon host for a Stardock-signed binary, hides the loader inside a genuine Microsoft NuGet package and strips Mark-of-the-Web from the MSI, while the loader, persistence script and RAT stay the same. Huntress’s conclusion is that detections tied to Canon or Stardock names will miss the next swap, and we agree.
How to detect the ClickFix attack without leaning on RunMRU
Most ClickFix detection keys on the RunMRU registry key, which records commands launched from the Run dialog. SigmaHQ’s rule matches a URL there alongside a lure word or a LOLBin, and it is worth keeping. This campaign sits near its blind spots, though. If victims paste into a terminal window, as Huntress’s wording suggests, RunMRU never sees the command, the same gap Unit 42 flagged for the Win+X variant. The decimal IP exists to beat string matching either way. So we anchor on the sequence Huntress saw in every variant, PowerShell to msiexec to sideload to persistence to RAT, starting with the installer hand-off.
Data source: Windows process creation (Sysmon Event ID 1, or Security Event ID 4688 with command-line auditing), any Sigma backend
title: PowerShell Hands a Temp-Folder MSI to msiexec
id: 752f1a30-8815-4a94-a005-c49a3d6eb3e0
status: experimental
description: >
Detects PowerShell launching msiexec against an MSI staged in a Temp
folder, the ClickFix-to-installer hand-off reported by Huntress in the
Plus 5.6 Custom GPT campaign (September 2026).
references:
- https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
author: MarkCyber Research
date: 2026-09-30
tags:
- attack.execution
- attack.t1204.004
- attack.defense-evasion
- attack.t1218.007
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\powershell.exe'
- '\pwsh.exe'
selection_child:
- Image|endswith: '\msiexec.exe'
- OriginalFileName: 'msiexec.exe'
selection_path:
CommandLine|contains|all:
- '\Temp\'
- '.msi'
condition: all of selection_*
falsepositives:
- Deployment scripts and RMM agents that stage MSIs in a user's Temp folder
level: highAllowlist packaging tools by parent command line or signer rather than muting the rule. It will miss a stager that drops the MSI outside Temp, which is why the second rule watches the far end of the chain, where the RAT calls resolvers that a line-of-business process has no reason to touch.
Data source: Sysmon Event ID 3 (network connection, disabled by default, so enable it for non-browser processes first), any Sigma backend
title: Non-Browser Process Connects to a Public DoH Resolver
id: 5f18f93a-82ea-4ede-ae8b-c44313c3d095
status: experimental
description: >
Detects a non-browser process opening HTTPS connections to the public
Cloudflare, Google or Quad9 DNS-over-HTTPS resolvers, the C2 lookup method
of the RAT delivered by the Plus 5.6 Custom GPT campaign.
references:
- https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
- https://attack.mitre.org/techniques/T1572/
author: MarkCyber Research
date: 2026-09-30
tags:
- attack.command-and-control
- attack.t1572
logsource:
category: network_connection
product: windows
detection:
selection_doh_ip:
Initiated: 'true'
DestinationPort: 443
DestinationIp:
- '1.1.1.1'
- '1.0.0.1'
- '8.8.8.8'
- '8.8.4.4'
- '9.9.9.9'
- '149.112.112.112'
selection_doh_host:
Initiated: 'true'
DestinationPort: 443
DestinationHostname|endswith:
- 'cloudflare-dns.com'
- 'dns.google'
- 'dns.quad9.net'
filter_main_browsers:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
- '\opera.exe'
condition: 1 of selection_doh_* and not filter_main_browsers
falsepositives:
- Windows DNS client where an administrator configured DoH to these resolvers
- VPN clients and developer tools with their own DoH settings
level: mediumWindows 11 can run its own DNS client over DoH, so expect svchost.exe hits wherever someone enabled that, and allowlist by path and signer. It is blind to an implant that injects into a browser or picks a resolver outside the list, which is the price of a rule quiet enough to alert on.
Huntress’s other two signals are better hunted than alerted on: a signed binary running from a fake product folder under AppData, and a Run key or scheduled task that comes back after you delete it. Search back to at least September 1, 2026, since the campaign’s start date has not been published. If you find the pair, kill the process before removing either entry, because a live implant rebuilds what you delete. This is the shape of detection work we build in AI-driven SOC engagements, rules tied to behavior an operator cannot rotate cheaply and tested against the client’s telemetry before they page anyone.
For mapping, the chain covers T1583.008 malvertising, T1204.004 Malicious Copy and Paste, T1218.007 for msiexec, T1574.001 DLL for the sideload, T1547.001 and T1053.005 for persistence, and T1572 for the DoH-resolved C2.
Indicators
For a quick sweep of the first wave, these are the published values, and every one of them will rotate faster than the behavior. The two Custom GPTs sat at chatgpt[.]com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6 and chatgpt[.]com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6.
| Type | Value |
|---|---|
| MSI | ISOSimple.msi |
| Signed host | COTFileReadApp.exe (Canon); a Stardock binary in version two |
| Sideloaded DLLs | ceiinfolog.dll, rdCore.dll |
| Loader carrier | Common.Integrator.Preview.wav |
| Payload store | monitor.raw |
| Persistence | Run value and scheduled task named Canon Configuration Reader |
| Dropped binary | GOMCam2024.exe, launching Chrome with a throwaway %TEMP% profile |
ClickFix remediation and mitigation
There is no patch, because nothing here is a vulnerability. Microsoft’s ClickFix guidance is the right baseline. Disable the Run dialog through Group Policy where users do not need it, block native binaries launched from Run with App Control, and turn on PowerShell script block logging. Add the attack surface reduction rule against obfuscated scripts and Windows Terminal’s multi-line paste warning. None of that is new, and yet we still find fleets where a standard user can paste straight into unrestricted PowerShell.
Next, take DoH away from everything except the resolvers you run. Blocking egress to public DoH endpoints and pinning browser DoH policy to your own resolver turns the RAT’s quiet lookups into failed connections your firewall logs. Where you can deploy it, Windows 11’s Zero Trust DNS goes further and blocks traffic to any address your approved resolvers did not hand out.
Then go back to the person from the opening, who did everything we asked and still lost. If staff must search for an AI tool to reach it, the search ad is part of your attack surface. Publish the sanctioned address in your SSO portal and managed bookmarks, the move we argued for in our shadow AI governance piece. The December 11 retirement closes this particular door, not the pattern, and we expect the next wave to ride whatever user-published content chatgpt.com hosts after GPTs are gone.
Bottom line
The person who clicked that ad checked the domain, and the domain was genuine. Stop treating that check as a control. Ship both Sigma rules, hunt for twin Run-key and scheduled-task persistence back to September 1, 2026, and give users a sanctioned path to AI tools so a search ad is never the front door.