Researchers from Huntress have identified an active campaign in which threat actors created a custom GPT named Plus 5.6 on the legitimate ChatGPT.com platform to distribute a remote access trojan targeting Windows users.
The attack begins when users searching for ChatGPT encounter a sponsored result on Google that leads to the malicious GPT. Once engaged, the bot consistently responds that the main service is experiencing problems and directs victims to a backup domain hosted on Google Sites.
The landing page presents a fake Cloudflare verification screen that activates the ClickFix technique, instructing the user to copy a command and paste it into the Windows Run dialog or terminal. Execution of the command starts a multi-stage infection chain that ultimately deploys a remote access trojan.
The resulting malware grants attackers full remote control of the compromised system, including the ability to browse files, capture screenshots, and activate the webcam and microphone.
Huntress documented at least 40 incidents connected to the specific malicious site used in this campaign. Only two confirmed infections were directly attributed to the custom GPT itself. Following notification, OpenAI removed the first GPT on September 25, yet investigators discovered a replacement instance tied to the same operation just two days later on September 27.
The core deception relies on the trust users place in the official ChatGPT.com domain and its top search ranking, even when the content originates from an unverified third-party author.
