Date: October 2, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: AI Security / Social Engineering / Malware Analysis / Threat Intelligence
Tags: OpenAI, ChatGPT, Custom GPTs, ClickFix, NetSupport RAT, Lumma Stealer, Huntress, Phishing, Social Engineering
Executive Summary
In late September and early October 2026, threat researchers at Huntress Labs and reporting from The Hacker News, CISO Series, and SOC Prime uncovered a deceptive cyber campaign exploiting ChatGPT Custom GPTs to distribute infostealers and remote access trojans (RATs). Cybercriminals published weaponized, publicly accessible Custom GPTs on the official OpenAI GPT Store, impersonating legitimate productivity utilities such as document converters, PDF analyzers, and SEO research tools.
During user interactions, the malicious bot triggers an artificial "display error" and presents users with a simulated verification dialog—a tactic widely known as ClickFix. The bot instructs the victim to copy a snippet of code and paste it directly into their Windows Run dialog (Win+R). In reality, the pasted string executes an obfuscated PowerShell script that downloads and deploys the NetSupport RAT and Lumma Stealer, granting adversaries complete interactive remote control over the victim's workstation and harvesting browser passwords, session tokens, and cryptocurrency wallets.
Technical Deep-Dive: Deconstructing the Custom GPT ClickFix Infection Chain
The campaign represents a sophisticated evolution of trust exploitation, combining legitimate AI platform infrastructure with established endpoint social engineering:
1. Ingress & Platform Legitimacy Exploitation
Attackers abuse public trust in the OpenAI platform to bypass traditional web security controls:
* Hosted on Official Infrastructure: Because the malicious Custom GPTs operate on chatgpt.com, links to the bots bypass corporate web proxies, reputation filters, and endpoint security gateways that routinely allow traffic to official OpenAI domains.
* Search Engine Optimization (SEO) & Malvertising: Threat actors promote links to their malicious Custom GPTs via sponsored search advertisements and SEO poison techniques targeting terms like "free PDF merger," "online OCR tool," and "resume analyzer."
2. The ClickFix Social Engineering Trigger
Once a user engages with the Custom GPT and submits a file or prompt, the bot executes its malicious prompt logic:
* The Fabricated Compatibility Error: The Custom GPT responds with a realistic notification claiming: "Error 0x80040154: Windows font rendering or web runtime environment is outdated. To display your document correctly, please run the environment sync fix below."
* The Copy-Paste Trap: The bot displays a user-friendly instruction card:
1. Press Windows Key + R to open the Run box.
2. Press Ctrl + V to paste the verification command.
3. Press Enter to run the fix.
* Clipboard Manipulation: Clicking the "Copy Fix Code" button copies a base64-encoded, single-line PowerShell command to the user's clipboard.
3. Payload Execution, DLL Sideloading, and Persistence
When the victim executes the command in the Windows Run prompt, the execution chain initiates:
* Stage 1 (PowerShell Dropper): The PowerShell command invokes Invoke-WebRequest to pull an encrypted ZIP archive from external attacker-controlled infrastructure (such as Cloudflare Workers or compromised WordPress blogs).
* Stage 2 (DLL Sideloading): The archive extracts a legitimate, signed executable alongside a malicious dependency DLL. When executed, the legitimate application sideloads the rogue DLL into memory, bypassing standard Windows Defender signature detection.
* Stage 3 (NetSupport RAT & Lumma Stealer Deployment): The implant installs NetSupport RAT—a commercial remote administration tool weaponized for malicious access—and executes Lumma Stealer to scrape Chromium/Gecko browser databases, decrypt saved passwords, and exfiltrate multi-factor authentication (MFA) session cookies.
Attack Parameter
Forensic Finding
Abused Platform
OpenAI ChatGPT Custom GPTs / GPT Store
Social Engineering Vector
ClickFix (Simulated runtime/font error requiring manual Win+R command)
Execution Medium
Native Windows Run dialog (Win+R) executing obfuscated PowerShell
Evasion Technique
DLL Sideloading using signed third-party binaries
Final Payloads
NetSupport RAT (Remote Control) & Lumma Stealer (Credential/Session Theft)
Impacted Platforms
Windows 10 and Windows 11 enterprise and consumer endpoints
Investigative Entity
Huntress Threat Research & SOC Prime Active Threats
The Dangers of "Living off the Trust" in AI Ecosystems
This campaign highlights a critical blindspot in modern enterprise defense:
* Legitimate Domain Shielding: Traditional email and web gateways cannot inspect interactive prompts inside third-party SaaS chat sessions.
* User Conditioning: Users have become accustomed to copying code, scripts, and commands generated by AI assistants, making the instruction to copy-paste commands into a terminal feel natural and harmless.
Recommendations and Mitigations
Organizations and enterprise security teams should implement the following defensive countermeasures:
1. Restrict Untrusted PowerShell Execution: Enforce Windows AppLocker or Software Restriction Policies (SRP) to block PowerShell from executing arbitrary commands initiated from user-writable temporary directories (%TEMP%, %APPDATA%).
2. Deploy Endpoint Behavioral Blocking for Win+R Droppers: Configure Endpoint Detection and Response (EDR) detection rules that flag and terminate instances where explorer.exe (Run dialog) spawns powershell.exe with base64-encoded command parameters.
3. Conduct User Awareness Training on ClickFix Techniques: Educate employees that legitimate web applications, cloud platforms, and AI assistants will never require running command-line instructions in the Windows Run dialog or PowerShell to fix browser display issues.
4. Implement Browser Isolation and Credential Protection: Utilize enterprise browser management solutions that prevent browser-stored credential extraction and enforce hardware-bound passkeys to mitigate session cookie theft.