A deception campaign has emerged that begins on a platform millions already trust. Huntress investigators discovered malicious actors exploiting OpenAI's Custom GPT feature to spin up a bot named "Plus 5.6"—deliberately worded to resemble an official model. The goal: convince victims they need a "backup domain" that actually delivers malware.
How the Scam Works
The fake bot exploited ChatGPT's own infrastructure. Since Custom GPTs run on ChatGPT.com, the browser bar showed an authentic address, making users less suspicious. In some incidents, the malicious link even appeared as a sponsored search result above legitimate ChatGPT entries in Google.
No matter what queries users entered, the bot delivered identical responses. It warned of service disruptions and provided a "backup domain"—actually a Google Sites page masquerading as a Cloudflare verification screen.
The ClickFix Tactic
This fake check relied on ClickFix, a social-engineering method that puts victims in charge of their own compromise. Instead of exploiting a vulnerability, it presented a problem and offered a "fix." Users were instructed to copy a Windows command and paste it into their system—framed as routine verification.
That command triggered a hidden download chain installing a remote-access trojan. Once active, the RAT gave attackers full visibility: screen viewing, file searches, webcam and microphone access, system audio capture, and the ability to deploy additional payloads. Huntress linked at least 40 incidents to this campaign, though only two confirmed infections originated directly from the Custom GPT.
AI-Themed Attacks Are Exploding
Separate findings from Kaspersky paint a broader picture. In 2026 alone, the security firm documented roughly 92,000 attacks disguising themselves as AI services. Fake ChatGPT apps comprised nearly half. Counterfeit Claude and Gemini apps each represented about 18%. The firm also catalogued over 15,000 malicious samples mimicking agentic AI tools—encompassing trojans, spyware, exploits, downloaders, and backdoors.
Ryu pointed out that as AI capabilities expand, teams often abandon verification steps to keep pace. That creates multiple entry points for attackers. A developer hunting for an AI coding tool might grab a convincing fake. An employee could add an AI assistant without the vetting they'd apply to traditional enterprise software.
Why Developers Are Prime Targets
Think about what sits on a developer's machine: source code repositories, cloud credentials, API keys, package manager tokens. Many AI coding agents also have file-reading permissions, code-modification rights, and command-execution access. A compromised developer workstation can become a gateway to an entire software supply chain.
Ryu highlighted the March 2026 compromise of Axios, a widely-used JavaScript library. Attackers hijacked a maintainer's computer and published poisoned versions through the npm account. Malicious packages remained live for hours before removal.
What to Watch Next
OpenAI removed one fraudulent Custom GPT on September 25, but researchers discovered a linked variant two days later. Expect copycat builders targeting other AI platforms. For teams, reinforce one rule above all: never paste commands from any webpage, no matter how legitimate the site looks.
Key takeaways
- Threat actors built a fake Custom GPT on ChatGPT.com to abuse existing trust in the platform
- Victims were sent to a fake Cloudflare page and tricked into running Windows commands themselves
- The resulting RAT grants attackers screen access, file control, webcam/microphone use, and more
- Kaspersky documented 92,000 AI-themed attacks in 2026, with fake ChatGPT representing the largest share
Frequently asked questions
How did the fake ChatGPT campaign infect computers?
Victims encountered a fake security page and were instructed to paste a Windows command—a technique called ClickFix. Executing that command installed a remote-access trojan on their system.
How did victims find the fake ChatGPT page?
Some reached it through sponsored Google Search results appearing above legitimate ChatGPT entries. The Custom GPT also ran on the genuine ChatGPT.com domain, adding false credibility.
What capabilities does the installed malware have?
The RAT enables full remote control: viewing the screen, accessing files, activating the webcam and microphone, capturing audio, and downloading further malicious software.
How widespread are AI-themed malware attacks?
Kaspersky identified approximately 92,000 such attacks in 2026, with fake ChatGPT applications responsible for nearly half of all incidents.
How can teams defend against these threats?
Treat AI tool installations with the same scrutiny as any enterprise software. Never run commands pasted from web pages, and verify URLs carefully—even when they appear to come from trusted domains.
Sources: androidauthority.com, business-standard.com