Attackers used ChatGPT Custom GPTs and Google Sites to deliver a ClickFix social-engineering lure that persuaded victims to run a PowerShell command, leading to a multistage infection and installation of a remote access trojan (RAT), according to Huntress. The campaign was observed in late September 2026 and affected dozens of users, with the Huntress security operations center responding to at least 40 incidents tied to the Google Sites domain used in the attack.
Key Points
- Attacker-created Custom GPTs on chatgpt.com directed users to a Google Sites page that displayed a fake Cloudflare CAPTCHA and a ClickFix command prompt.
- The PowerShell command downloaded an MSI that abused signed Canon or Stardock software for DLL sideloading and executed a hidden loader.
- The final RAT supported remote desktop access, screen broadcasts, camera, microphone and system-audio capture, browser targeting, file searches, reconnaissance and additional payload deployment.
- Huntress confirmed that two of at least 40 incidents tied to the Google Sites domain came through a Custom GPT instance and published detection guidance and indicators.
How the lure worked
The attackers created Custom GPT pages on chatgpt.com, including instances titled “Plus 5.6.” The pages displayed a “Service Availability Notice” and directed users to a “backup” link hosted on Google Sites. The page at hxxps://sites.google[.]com/view/antibot172881 presented a fake Cloudflare CAPTCHA before instructing the user to paste and run a PowerShell command.
Huntress described the initial sequence as a ClickFix-style attack that used trusted domains to make the instructions appear credible. The researchers said the Custom GPTs were programmed to respond to user prompts with the Google Sites link.
Huntress described the user-facing chain:
“In the incidents we saw, victims interacted with an attacker-created Custom GPT, which was programmed to respond to their prompts with a message that included a Google Sites link. This link then brought them to a ClickFix-style attack, which led to the download and execution of a malicious MSI installer.”
Huntress
The malicious PowerShell command was an obfuscated one-line script encoded as large integer arrays. It decoded its contents in memory, forced the use of TLS 1.2, wrote an installer to %TEMP% with a GUID-based name such as GUID_nnn_ISOSimple.msi, and silently invoked msiexec. Huntress observed the process pattern powershell.exe launching msiexec.exe with an installation command such as msiexec /i %TEMP%\<GUID>_ISOSimple.msi /qn /norestart.
Some download URLs used the decimal representation 1614733393 instead of a conventional dotted IP address. Huntress resolved that value to 96.62.224.81. Observed MSI paths included hxxp://1614733393/app/afafa98279c9/ISOSimple[.]msi, hxxp://1614733393/app/50d6565cf39e/IconEdit2Turb[.]msi and hxxp://1614733393/app/a26b67343315/UltraFreeISOCreateWizardSolution[.]msi.
Multistage infection
Huntress analyzed ISOSimple.msi, which used the product name “Advanced Printer Configuration Reader.” The installer placed files under %LOCALAPPDATA%\Programs\<product> and used a custom action to immediately execute the legitimately signed Canon binary COTFileReadApp.exe.
The package also contained a modified Canon logging library named ceiinfolog.dll. Its signature had been removed, and the library imported the attacker-controlled rdCore.dll. The arrangement caused the signed Canon executable to load the malicious code through DLL sideloading.
In one version of the chain, rdCore.dll read a shellcode loader from a WAV file named Common.Integrator.Preview.wav. The loader began at offset 0x24362, occupied 341,395 bytes, was XOR-decoded, mapped into memory and executed as position-independent x64 shellcode.
A second version replaced the WAV carrier with compressed data stitched into a Microsoft NuGet package named Build.dat. That version also changed the signed host binary from Canon’s COTFileReadApp.exe to Stardock’s DeElevate64.exe. Huntress said the reuse of the same RAT kit with different signed hosts and carriers indicated a framework that could be repackaged for different delivery chains.
The loader searched for an encrypted storage file named monitor.raw in the observed samples. Huntress found that the file implemented a custom encrypted archive filesystem with a header and an index containing 1,128 entries. The archive stored a persistence script and the final RAT payload.
The persistence script recreated two mechanisms on timers: an HKCU Run value and a scheduled task. Version one used the name “Canon Configuration Reader,” while version two used “Stardock DeElevation Tool.” The script also enabled execution of the final in-memory payload through @input.
RAT capabilities and evasion
The RAT supported remote desktop sessions and screen broadcasts, camera, microphone and system-audio capture, browser targeting and a file manager with content search. Huntress found references to 17 browsers and functionality to launch the system’s default browser. The malware could also drop and execute EXE, DLL, MSI, PowerShell, batch, VBScript, JScript and ZIP payloads.
The malware enumerated installed antivirus products through Windows Management Instrumentation, collected domain and domain-controller information, and performed detailed hardware fingerprinting. Its communications used DNS over HTTPS through Cloudflare, Google and Quad9 to locate a command-and-control system called “Gate,” allowing lookups to appear within ordinary HTTPS traffic. The specific command-and-control host was not present in the recovered files.
Huntress identified an amsi.dll bypass targeting amsi.dll, ntdll unhooking intended to evade user-mode EDR hooks, and checks for virtualized environments. The checks examined the CPU vendor string and searched for VMware, VirtualBox, Hyper-V, QEMU, Xen and Parallels drivers or services. The loader also encrypted strings and assembled them at runtime to reduce static-detection signals.
Jonathan Semon of Huntress described the RAT’s purpose and capabilities:
“Left alone, though, this RAT is built to do three things: steal data, watch the people using the machine, and serve as a foothold into the rest of the network. It can run hidden remote desktop sessions, turn on the camera and microphone, search every file on the machine, create its own user accounts, and pull in whatever the attacker wants next.”
Jonathan Semon, Huntress
Scope and timeline
Huntress researchers Mark O’Halloran and Jonathan Semon investigated the campaign. The operators were not identified. Huntress reported that the initial malicious Custom GPT had been taken down by September 25, 2026, but found another Custom GPT linked to the same campaign on September 27.
Huntress’s security operations center responded to at least 40 incidents associated with the specific Google Sites domain. Two of those incidents were confirmed to have originated through a Custom GPT instance. Semon said Huntress updated detections quickly enough that it got ahead of most of the chains and isolated the affected machines before the second round of tools landed. In the incidents examined by Huntress, the most common next step after the initial compromise was the installation of additional malware, including payloads intended to steal browser data and map the endpoint.
Huntress observed that some malicious DLLs had a compilation timestamp of September 24, 2026, at 22:46 UTC. Telemetry also showed a third MSI on the same server on September 23, 2026. In at least one incident, Microsoft Defender quarantined ISOSimple.msi as Trojan:Script/Wacatac.H!ml after installation, but the Run key and scheduled task had already been created and the infection chain continued.
Detection and mitigation
Huntress recommended monitoring for PowerShell launching msiexec.exe to install a GUID-named MSI from %TEMP%. Other signals include COTFileReadApp.exe or DeElevate64.exe running from a product directory under %LOCALAPPDATA%\Programs after being launched by msiexec.exe, rather than from a legitimate installation path.
Defenders should also look for the persistence names “Canon Configuration Reader” and “Stardock DeElevation Tool,” especially when the corresponding Run value or scheduled task reappears after deletion. Huntress identified unsigned or modified libraries in the same directories as the signed host, including ceiinfolog.dll, rdCore.dll, WPFLocalizeExtension.dll and WMPCL.dll, as additional detection signals.
Huntress said security teams should account for the use of legitimate ChatGPT and Google Sites domains in awareness training and detection programs. The organization advised users to evaluate what a website or chatbot is asking them to do, not only whether the domain appears familiar.
“No website, chatbot, support page, or ‘verification tool’ has a legitimate reason to tell you to paste a command into PowerShell or any Terminal to verify who you are, no matter how polished it looks.” – Huntress
Huntress published the observed Custom GPT URLs, Google Sites page, MSI download paths, file hashes and process indicators for investigation. Selected hashes include the SHA-256 values e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb for the Advanced Printer Configuration Reader MSI, b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe for the patched Canon DLL, ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907 for the loader decoded from the WAV file, and 278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48 for the RAT decoded from monitor.raw.
Sources
About the Author
