Hackers host fake ChatGPT model on its official website — but really it's just malware
A fake model leading to a fake CAPTCHA... what could go wrong?
Cybercriminals exploited a ChatGPT feature named "Custom GPT" and Google Sites to distribute a dangerous malware known as ClickFix. By creating a custom GPT, hackers were able to craft a convincing fake troubleshooting prompt that lured unsuspecting users to execute malicious commands. The false message, "We're currently experiencing limited availability on the primary domain," directed victims to a backup domain hosted on Google Sites.
Upon visiting this site, users were asked to copy and paste a piece of code into the Windows Run program, which initiated the ClickFix attack. This malware, referred to as "@input" by security experts, granted attackers extensive control over the infected Windows computer. They could monitor the user's screen, operate the device remotely, access webcam and microphone, and search through every file on the system.
In most cases, the malware successfully completed these actions without the victim's knowledge. The hackers employed encrypted lookouts to maintain their anonymity while communicating with the malware operators. OpenAI, the company behind ChatGPT, removed the custom GPT on September 25, but a new version appeared just two days later.
This attack highlights the increasing use of trusted AI platforms in social engineering attacks, as cybercriminals leverage legitimate services to deceive victims and deploy dangerous malware.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
