Malicious Custom GPTs Deliver ClickFix Attacks That Install Remote Access Trojans on Victim Machines — Updates TTO-2026-0929-181

Summary

Security researchers have documented a specific variant of the malicious Custom GPT campaign reported in TTO-2026-0929-181 in which the delivery mechanism is ClickFix — a social engineering technique that presents victims with a fake CAPTCHA or error resolution prompt and instructs them to paste a PowerShell command into their terminal to “fix” the issue. The GPT presents what appears to be an error or verification requirement, instructs the user to open a terminal and paste a provided command, and the command downloads and executes a remote access trojan. AsyncRAT, QuasarRAT, and XWorm have been observed as payloads.

Timeline

What Changed

TTO-2026-0929-181 documented malicious Custom GPTs delivering phishing pages and malware downloads through ChatGPT Actions. The ClickFix variant uses a different and more effective delivery mechanism: rather than directing the victim to an external URL, the GPT instructs the victim to manually paste a PowerShell command into their own terminal.

ClickFix is effective because it shifts execution to the operating system terminal, which has no content inspection. Antivirus tools and endpoint detection products that would flag a downloaded executable often do not flag a user manually executing a PowerShell command they typed themselves. The Custom GPT variant adds trust amplification: a victim who receives a ClickFix prompt on a random website is suspicious, but a victim receiving the same prompt from an AI assistant they have been conversing with for several minutes is substantially more likely to comply. The GPT establishes context and trust before presenting the ClickFix prompt, making the social engineering significantly more effective than standalone ClickFix pages.

Domain Intelligence

openai.com — 56.91

Score unchanged from TTO-2026-0929-181. openai.com scores in the low-trust range at 56.91.