Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

Threat actors are using ChatGPT Custom GPTs to create fake product offerings that appear legitimate, leading victims to malicious websites. These websites use ClickFix lures to deliver malware, specifically a remote access trojan (RAT). This activity was observed by Huntress in late September 2026. The abuse of ChatGPT Custom GPTs is part of a larger trend of exploiting features in trusted artificial intelligence platforms. Previous campaigns have also leveraged shared features in AI platforms for malicious purposes. The discovery highlights the ongoing efforts of threat actors to find new ways to use AI platforms for cyber attacks.