Cybercriminals have combined a legitimate function of ChatGPT with ClickFix attacks to infect victims with malware, researcher have found.

Uncovered by cybersecurity firm Huntress, the malware campaign, which has been active since September, abuses the CustomGPT feature of ChatGPT. CustomGPTs are personalized versions of ChatGPT which users can build to follow specific instructions and workflows.

As detailed in a blog post by Huntress, the attackers manipulated ChatGPT CustomGPTs to impersonate legitimate product offerings and even to interact with victims, to direct them to sites which deliver malware.

The attackers developed a CustomGPT called Plus 5.6 which is designed to look like the real ChatGPT. According to Huntress, users are directed to Plus 5.6 via sponsored search results after looking for ‘chatgpt’ on Google.

If a user visits the site, the CustomGPT delivers a “Service Availability Notice” which claims there is limited availability for the model on the “primary domain” but directs them to a link for a “backup domain”.

ClickFix Attack Disguised as CAPTCHA

This backup domain initially looks like a CloudFlare CAPTCHA check, which asks the user to paste a command to ‘verify’ themselves.

This is the ClickFix attack, a popular attack technique among cybercriminals, which uses social engineering to trick the victim into running attacker-supplied commands on their own machine. Because the victim themselves has run the command, the ClickFix attack often bypasses any security protections on the machine.

“Every step of the attack also borrows a brand people already trust, from ChatGPT and Google to Cloudflare and even Canon software. The takeaway is simple. No legitimate website will ever ask you to copy and paste a command to prove you’re human,” the company said.

This link directs the user to a malicious Microsoft Software Installer (MSI) which is used to deploy a legitimate Canon-signed application the attackers have used to sideload malicious code, this ultimately establishes persistence on the machine and delivers remote access trojan (RAT) malware.

This RAT can be used to monitor the infected system, including the ability to capture audio and video from microphones and cameras, as well exfiltrate data to a command and control server operated by the attackers. The RAT can also be used to deliver additional malware and malicious payloads to the machine.

According to analysis by Huntress, there have been at least 40 infections related to the campaign. The researchers reported the Plus 5.6 CustomGPT to Open AI, which was taken down as of September 25.

However, researchers have already identified a new CustomGPT linked to the same campaign and Huntress has warned ChatGPT users to be cautious.