Malicious ChatGPT Custom GPTs on chatgpt.com Push ClickFix and a RAT

Windows users searching for ChatGPT

Huntress reported on September 28, 2026 that paid Google search ads led victims to a Custom GPT named "Plus 5.6" hosted on the legitimate chatgpt.com domain. The GPT answered every prompt with a "Service Availability Notice" directing users to a "backup domain" on Google Sites, which showed a fake Cloudflare CAPTCHA and a ClickFix PowerShell command. That installed an MSI that sideloaded a DLL through a Canon-signed binary (a second version used Stardock's `DeElevate64.exe`) and delivered a RAT with remote desktop, camera and microphone capture, file search, and payload execution, persisting as "Canon Configuration Reader." Huntress investigated at least 40 incidents tied to the Google Sites page, two confirmed to start at the Custom GPT. OpenAI removed the first GPT on September 25; a replacement with the same name was found on September 27

User-published GPTs inherit the AI vendor's domain and reputation, and paid search placement put that trust in front of victims before any content check