Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

Immediate Actions

Key Takeaways

• RAT shellcode hash is identical between V1 (Canon) and V2 (Stardock) variants
• Loader hides encrypted shellcode at offset 0x24362 in a .wav file with valid RIFF header
• RAT uses DNS-over-HTTPS via Cloudflare, Google, and Quad9 for C2 resolution
• Persistence self-heals: script re-creates Run key every 150s and scheduled task every 875s
• V2 strips Mark-of-the-Web from MSI before execution to bypass SmartScreen

Attack Chain

1. Initial Access: Malicious Custom GPT on chatgpt.com lures victims via Google Ads sponsored result
2. Execution: Google Sites ClickFix page tricks user into running PowerShell irm command
3. Persistence: Obfuscated script downloads MSI, installs silently, creates Run key and scheduled task
4. Defense Evasion: MSI sideloads patched DLL via legitimate Canon-signed COTFileReadApp.exe
5. Execution: rdCore.dll XOR-decodes shellcode from .wav file and executes in memory
6. C2: Loader unpacks RAT from encrypted archive; RAT resolves C2 via DNS-over-HTTPS

Affected Systems

• Windows endpoints with PowerShell and MSI support
• ChatGPT users searching via Google Ads
• Google Search users clicking sponsored results

Detection Availability

No detection rules or queries are published in the source article.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Sysmon Event ID 1 (process creation)
• Sysmon Event ID 7 (image load)
• Sysmon Event ID 11 (file creation)
• PowerShell Script Block Logging (4104)
• Windows Task Scheduler operational log
• Registry modification events (4657)

Key Behavioral Indicators

• powershell.exe spawning msiexec.exe with GUID-named MSI in %TEMP%
• COTFileReadApp.exe or DeElevate64.exe running from %LOCALAPPDATA%\Programs
• HKCU Run value and scheduled task sharing same name
• Unsigned DLLs loaded by signed application from same directory
• Process reading .wav file and allocating executable memory
• msiexec.exe launching signed application from non-standard install path

Control Gaps

• DNS-over-HTTPS C2 traffic invisible to local DNS monitoring
• Mark-of-the-Web stripping bypasses SmartScreen and attachment warnings
• In-memory shellcode execution evades file-based AV scanning
• Signed binary proxy execution bypasses application allowlisting
• Decimal-encoded IP addresses bypass dotted-IP URL filters

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Block DNS-over-HTTPS to cloudflare-dns.com, dns.google, dns.quad9.net if not required
• Filter decimal-encoded IP addresses in URL inspection pipelines
• Alert on Mark-of-the-Web removal from downloaded MSI files
• Block Google Sites pages matching ClickFix CAPTCHA lure patterns

User Protection

• Warn users about sponsored Google results for ChatGPT-related searches
• Disable Custom GPT access if not required for business operations
• Enable SmartScreen and enforce MOTW enforcement for downloaded installers
• Deploy EDR rules for unsigned DLLs loaded by signed executables in non-standard paths

Security Awareness

• Train users to verify Custom GPTs show by OpenAI not community builder
• Instruct users never to paste PowerShell commands from web pages into Terminal

MITRE ATT&CK Mapping

Plain-Language Summary

Attackers created fake ChatGPT chatbots that appear in Google search ads. When users interact with them, the chatbots direct victims to a fake security check page that tricks them into running a command. This command silently installs malware disguised as a printer tool. The malware hides its real code inside an audio file and an encrypted archive, then loads a remote access trojan that can control the computer, capture camera and microphone input, and steal browser data. Affected users should check for suspicious scheduled tasks and uninstall unknown programs.

Additional IOCs

• Urls:
  • hxxps://chatgpt[.]com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6 - V1 Custom GPT lure, taken down by OpenAI
  • hxxp://1614733393/s/50d6565cf39e - V2 stage-2 script URL (decimal IP)
  • hxxp://1614733393/app/50d6565cf39e/IconEdit2Turb.msi - V2 MSI download URL (decimal IP)
  • hxxp://1614733393/app/a26b67343315/UltraFreeISOCreateWizardSolution.msi - Third MSI on same server, not obtained
• File Hashes:
  • 14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335 (SHA256) - V1 obfuscated ClickFix stager script
  • c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7 (SHA256) - V2 ClickFix stager script
  • eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764 (SHA256) - Malicious WPFLocalizeExtension.dll helper
  • 9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d (SHA256) - Malicious WMPCL.dll helper loaded by rdCore
  • 54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31 (SHA256) - Audio file carrying encrypted loader shellcode
  • e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b (SHA256) - V1 encrypted archive with RAT and script
  • 20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53 (SHA256) - Loader shellcode decoded from .wav, memory only
  • 278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48 (SHA256) - Legitimate Canon-signed host binary, do not block
  • 22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4 (SHA256) - Legitimate Stardock-signed V2 host, do not block
  • 0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f (SHA256) - V2 patched Stardock DeElevator64.dll
  • 3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621 (SHA256) - V2 loader DLL I++u.dll
  • b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4 (SHA256) - V2 alloc/exec helper senddmp.resources.dll
  • a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6 (SHA256) - V2 network helper res.dll
  • d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e (SHA256) - V2 NuGet package carrying encrypted loader
  • d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90 (SHA256) - V2 encrypted archive with RAT and script
• Registry Keys:
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Canon Configuration Reader - V1 persistence Run key, self-healing
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Stardock DeElevation Tool - V2 persistence Run key, self-healing
• File Paths:
  • %LOCALAPPDATA%\Programs\Advanced Printer Configuration Reader\ - V1 fake install directory
  • %LOCALAPPDATA%\Programs\Stardock Smart DeElevation Tool\ - V2 fake install directory
  • %LOCALAPPDATA%\AppstorageFile\ - RAT follow-on payload drop directory
• Command Lines:
  • Purpose: Download and execute obfuscated stager script from remote server | Tools: powershell.exe | Stage: Execution
  • Purpose: Silently install malicious MSI payload in hidden window | Tools: msiexec.exe | Stage: Execution | msiexec.exe /i <path> /qn /norestart
• Other:
  • Canon Configuration Reader - V1 scheduled task name for persistence
  • Stardock DeElevation Tool - V2 scheduled task name for persistence