Researchers at Huntress discovered a malware campaign in late September 2026 that utilizes malicious custom GPTs hosted on chatgpt.com. Attackers used sponsored Google search results to direct users to these fake AI assistants, leveraging the trusted OpenAI domain to facilitate the initial stage of the attack.
The process involves redirecting victims to a fake Cloudflare CAPTCHA page on Google Sites. Users are prompted to execute a PowerShell command, which triggers an eight-stage ClickFix infection chain. This leads to the installation of a remote access trojan capable of remote desktop control and audio-video capture.
The attackers employed obfuscation techniques, such as using a decimal IP address, 1614733393, to bypass security filters. Huntress linked the infrastructure to over 40 incidents, with at least two confirmed as originating from the malicious GPTs. OpenAI removed the first instance on September 25, 2026, but a replacement appeared on September 27.
This campaign highlights the risks of domain-based trust policies, as attackers exploit the credibility of the OpenAI platform. Security experts recommend monitoring for specific PowerShell execution patterns, including those that fetch MSI installers or use decimal-encoded IP addresses.
