Attackers are using custom GPTs to implement ClickFix attacks in a new RAT campaign

Threat actors are abusing custom GPTs to deliver remote access trojan (RAT) malware through ClickFix attacks, highlighting how trusted AI platforms are becoming a new vehicle for an established social engineering technique.

The most effective cyberattacks are not always the most sophisticated. Often, success comes from the expectation that users will take the same actions they take every day. 

Researchers at cybersecurity firm Huntress recently identified threat actors abusing custom GPTs to deliver malware through ClickFix-style attacks. First observed over two years ago, ClickFix is a social engineering technique that tricks users into copying and running malicious commands themselves, often disguised as a CAPTCHA or routine verification step. It has since evolved into a widely used malware delivery method. 

The latest campaign suggests attackers are now adapting an established tactic to a new digital environment. More importantly, they are using the growing trust users place in AI-powered tools as a mechanism for malware delivery. 

While the use of custom GPTs may appear novel, the underlying attack chain is anything but. “There have been ClickFix campaigns that have been publicized for at least two years now,” said Michelle Alvarez, Manager of IBM X-Force Threat Intelligence, on a recent episode of the Security Intelligence podcast. According to Alvarez, the cybersecurity industry’s focus on artificial intelligence may sometimes overshadow the continued evolution of established threats. “I think maybe just all of this talk about AI and frontier AI finding vulnerabilities is sort of overshadowing this notable threat that seems to continue to evolve,” she said. 

The campaign reflects a broader trend in cybersecurity: attackers are increasingly repurposing trusted technologies and platforms to enhance the effectiveness of existing techniques rather than developing entirely new ones. 

According to Huntress, attackers created malicious custom GPT experiences that ultimately directed users to ClickFix workflows capable of deploying remote access malware. Additionally, reporting from BleepingComputer noted that the campaign relied in part on the credibility associated with the ChatGPT ecosystem, creating an environment where users may be more likely to trust the instructions they receive. 

That trust is important because these ClickFix attacks depend almost entirely on user interaction.

“The general kill chain is still the same steps, but it’s very powerful,” said Norman Dorsch, Product Manager with IBM X-Force. “The user is the one actually installing the payload during that ClickFix attack.”

Unlike exploits that target software vulnerabilities, ClickFix attacks target decision-making. Victims are commonly presented with prompts that resemble CAPTCHAs, browser verification checks or troubleshooting instructions. Microsoft researchers have observed threat actors using these techniques to convince users to execute commands that ultimately deliver malware, while Proofpoint researchers have documented the growing adoption of ClickFix across multiple threat campaigns.

This approach remains attractive to attackers because it shifts all the “heavy lifting” of the campaign to the victim. By persuading users to execute commands themselves, attackers can bypass many of the security controls designed to prevent unauthorized software installation.

As Dorsch explained, attackers frequently present the interaction as a routine verification step.

“Prove that you’re human, paste this command into your terminal and then it executes the payload,” he said. “It actually deploys the payload on the user’s system, and you get C2 [command and control].”

The use of custom GPTs also raises questions about how AI marketplaces and agent ecosystems will be governed as they continue to expand. Organizations have already faced similar challenges in app stores, browser extension repositories and software marketplaces. These are all places where malicious content can coexist alongside legitimate tools. 

“Whenever a company has a marketplace of sorts, it is expected that it will have, at some point, a level of responsibility in terms of pruning out what is proven to be malicious,” said Giacomo Casoni, Senior X-Force Incident Response Consultant at IBM. 

As enterprises continue to adopt AI assistants and agentic systems, trust will increasingly become a security boundary, the experts agreed. Users may not evaluate instructions from an AI-powered interface with the same skepticism they would apply to an email attachment or unfamiliar website. For instance, think about how frequently you may already blindly accept notifications from trusted messenger or office tools. Threat actors understand this dynamic and are beginning to incorporate it into existing social engineering playbooks. 

The Huntress findings suggest that organizations should think about AI security in broader terms than model vulnerabilities alone. Protecting users from malicious AI experiences may become just as important as securing the underlying models.

The takeaway for defenders should be that attackers do not need to compromise an AI system to benefit from it. They only need to convince users that the instructions coming from that system can always be trusted.