Huntress: fake Custom GPT "Plus 5.6" on chatgpt.com spread malware

The attack's entry point is not a fake website but a feature that lives inside ChatGPT itself. Custom GPTs run under the legitimate chatgpt.com domain, so from the user's side the page looks like an ordinary ChatGPT screen. Huntress notes the page even carried a "community builder" label marking it as third-party, but says users unfamiliar with how Custom GPTs work could still mistake it for the standard interface. Attackers leaned on that trust, naming the GPT "Plus 5.6" to resemble a genuine model and turning a search ad into the front door.

From there the chain left OpenAI's domain for Google Sites, where a Cloudflare-style CAPTCHA appeared and the supposed verification step was pasting a PowerShell command into Windows, a pattern Huntress calls ClickFix. Huntress reports this was more elaborate than typical ClickFix attacks, with an eight-stage infection path, and says it confirmed at least 40 incidents linked to the same Google Sites domain, two of them arriving through Custom GPT. The first Custom GPT it reported to OpenAI was removed by September 25, but another tied to the same campaign surfaced on September 27, and Huntress has previously seen shared ChatGPT conversations and shared Claude content used the same way.

What the outcome hinges on is speed: whether reported Custom GPTs are taken down before replacements appear, and whether search ads remain a viable way in. OpenAI said in September 2026 that Custom GPTs will be discontinued on December 11, 2026, which may narrow this particular route — though the broader approach of borrowing trust from well-known services to get victims to run commands themselves would not automatically disappear with it.