TLDR
Attackers are abusing OpenAI's custom GPT feature to promote malicious ChatGPT variants via sponsored Google results. Once installed, the rogue GPT redirects users to a Google Sites page hosting a fake Cloudflare verification check that...
How it works
Attackers are abusing OpenAI's custom GPT feature to promote malicious ChatGPT variants via sponsored Google results. Once installed, the rogue GPT redirects users to a Google Sites page hosting a fake Cloudflare verification check that...
Red flags
- : Sponsored Google ad for a custom GPT that redirects to an external site asking you to run commands A 'Cloudflare verification' or 'security check' that asks you to open PowerShell and paste text Unsigned or unusual processes spawned from %LOCALAPPDATA%\Programs\ followed by new Run key entries
What to do
- 1: Never copy paste and execute PowerShell commands prompted by a webpage, chatbot, or 'se
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/FAQ
Is Custom ChatGPTs push ClickFix attacks to deliver RAT malware a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: Sponsored Google ad for a custom GPT that redirects to an external site asking you to run commands A 'Cloudflare verification' or 'security check' that asks you to open PowerShell and paste text Unsigned or unusual processes spawned from %LOCALAPPDATA%\Programs\ followed by new Run key entries
What should I do first?
: Never copy paste and execute PowerShell commands prompted by a webpage, chatbot, or 'se
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.