Summary
Attackers are weaponizing OpenAI’s Custom GPT feature to create malicious GPT instances that impersonate legitimate services and deliver phishing content and malware through the ChatGPT interface. The malicious GPTs use ChatGPT’s Actions capability to redirect users to attacker-controlled external endpoints that harvest credentials or deliver malware downloads. Attackers are rapidly republishing malicious GPTs after takedowns to maintain availability.
Timeline
| Date | Event |
|---|---|
| Sep 29, 2026 | Malicious Custom GPT phishing and malware delivery campaign confirmed; rapid republication after takedowns documented |
What Happened
OpenAI’s Custom GPT feature allows users to create specialized GPT instances with custom instructions and Actions that call external APIs. Attackers have exploited this to create GPTs appearing to be legitimate service assistants and use GPT Actions to direct users to external endpoints for credential harvesting or malware delivery. The ChatGPT interface provides a veneer of legitimacy that increases victim trust compared to conventional phishing pages.
The rapid republication of malicious GPTs after takedowns indicates that attackers have operationalized creating new GPT instances as a standard evasion technique. Users should treat any Custom GPT that requests credentials, prompts software installation, or directs to external websites with the same skepticism applied to conventional phishing.
Domain Intelligence
openai.com — 56.91
openai.com scores in the low-trust range at 56.91. OpenAI is the platform whose Custom GPT feature was weaponized in the campaign.