A recent attack highlights an uncomfortable lesson for anyone using AI assistants: being on a legitimate domain no longer guarantees that the content you are looking at was created or approved by the company that owns that domain.

In late September 2026, Huntress researchers documented a campaign in which attackers created a Custom GPT called “Plus 5.6” and hosted it through the normal ChatGPT platform. The page genuinely lived under chatgpt.com, but the GPT was not an official OpenAI model. It was a community-built GPT programmed to send victims into a social-engineering chain that ended with the installation of a remote-access trojan.

Primary source: Huntress — Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

The distinction matters: Huntress did not report evidence that attackers compromised OpenAI’s infrastructure or “hacked ChatGPT.” They abused a legitimate platform feature.

Status verified on September 30, 2026. The campaign and associated artifacts may change quickly.

What actually happened

Huntress observed that some victims started with an ordinary Google search for “chatgpt.” A sponsored result took them to a Custom GPT page hosted on the legitimate ChatGPT domain.

The GPT was named Plus 5.6, a label designed to look like an official product or model version. Under the title, the page indicated that it had been created by a “community builder.” That can be a useful warning signal for experienced users, but it can easily be overlooked by someone who does not know how Custom GPTs work.

According to Huntress, interacting with the GPT produced essentially the same response: a supposed service-availability notice claiming that the primary service was having problems and offering a “backup domain.”

That link led to a page hosted on Google Sites.

That was where the real attack began.

The chain: Custom GPT → Google Sites → ClickFix → RAT

The observed flow can be summarized like this:

Google Search / sponsored ad
        │
        ▼
Custom GPT "Plus 5.6"
on chatgpt.com
        │
        ▼
"Backup domain"
on Google Sites
        │
        ▼
Fake CAPTCHA
        │
        ▼
Victim runs a command
in PowerShell
        │
        ▼
MSI download
        │
        ▼
DLL sideloading
        │
        ▼
Persistent RAT

The Google Sites page imitated a Cloudflare-style verification. It used ClickFix, a social-engineering technique that tries to convince the victim to manually copy and run a command to “fix” a problem, complete a verification, or unlock content.

That detail is critical: the browser did not need to exploit a Windows vulnerability. The victim was persuaded to execute the code manually.

After execution, the chain downloaded an MSI installer and deployed a RAT while abusing legitimately signed components and DLL sideloading.

Why ClickFix works so well

ClickFix is effective because it turns a dangerous action into something that looks like a normal technical step.

The victim may never see an obviously malicious executable at first. Instead, the instructions look like troubleshooting:

  • open a terminal or PowerShell;
  • paste a command;
  • press Enter;
  • wait for the “verification” to finish.

For people accustomed to technical tutorials, support guides, or commands copied from documentation, that flow can look plausible.

The practical rule should be much stricter:

A legitimate CAPTCHA does not require you to open PowerShell, Terminal, Win+R, or a shell and paste a command.

If a website asks you to do that to prove you are human, unlock content, or “repair” your browser, treat it as a major warning sign.

The legitimate-domain problem

For years, one of the most useful security habits has been to check the domain.

That is still useful, but it is no longer sufficient on platforms that host third-party content.

In this campaign, the first page could genuinely be under:

chatgpt.com

The TLS certificate was valid. The domain was real. The infrastructure belonged to the legitimate service.

The problem was different: the content running inside that trusted platform had been created by a malicious third party.

OpenAI describes GPTs as customized versions of ChatGPT configured for a specific purpose and capable of combining instructions, knowledge, and selected capabilities. That flexibility also means publicly shared GPTs can become a social-engineering surface.

Reference: OpenAI Help Center — GPTs in ChatGPT

This pattern is not unique to ChatGPT. It appears anywhere a trusted platform hosts user-generated content:

trusted domain
    ≠
trusted author
    ≠
trusted content

It was not a “secret ChatGPT model”

The name Plus 5.6 was part of the deception.

The attackers wanted the page to resemble a new official ChatGPT model. But the “community builder” label indicated that it was a third-party GPT.

That distinction matters whenever a page appears with names such as:

  • “GPT 6 Ultra”;
  • “ChatGPT Premium Model”;
  • “Developer Edition”;
  • “Experimental GPT”;
  • or any other label that looks like a new official model.

The fact that a page lives on chatgpt.com does not prove that the displayed name corresponds to an official OpenAI model.

New models, plans, and features should be verified through official documentation, release notes, and the model picker inside the product—not through an advertising link.

What the malware did

Huntress analyzed at least two variants of the chain.

In the first, attackers used a legitimate Canon-signed application to load a malicious DLL through sideloading. In a later variant they changed the wrapper and used Stardock components, while researchers found that the final RAT was effectively the same payload.

The malware provided capabilities typical of a remote-access trojan, including:

  • remote command execution;
  • file access;
  • screen capture;
  • browser interaction;
  • persistence;
  • delivery of additional payloads;
  • and access to devices such as a camera or microphone depending on permissions and environment.

It also used techniques intended to blend in with legitimate software and make analysis harder.

How many incidents were involved

Huntress said its SOC responded to at least 40 incidents associated with the Google Sites domain used in the campaign.

That does not mean all 40 victims arrived through the Custom GPT.

The researchers were more precise: Huntress confirmed that two of the observed incidents began through a Custom GPT instance.

That distinction matters because it avoids inflating the scale of one specific entry vector from the total number of cases tied to shared campaign infrastructure.

OpenAI removed the first GPT, but another appeared

Huntress reported the first instance to OpenAI and said it was taken down on September 25, 2026.

However, on September 27, researchers found another Custom GPT tied to the same campaign.

That reflects a common feature of modern malicious operations: removing one URL or account does not necessarily dismantle the entire operation. Attackers can rotate names, pages, binaries, and infrastructure while preserving the same overall attack chain.

What users should look for

Several signals should immediately increase suspicion:

  1. A supposed new model appears through an ad or external link.
  2. The creator is shown as a “community builder” or similar third party.
  3. The GPT claims the official service is unavailable and offers a “backup domain.”
  4. The link leaves the original platform.
  5. A CAPTCHA asks the user to run local commands.
  6. The instructions require PowerShell, Terminal, Win+R, or another shell.
  7. The “verification” ends with an MSI, EXE, script, or compressed download.

Any single signal may not prove compromise. The combination is enough to stop.

What if you only visited the page?

In the chain documented by Huntress, simply opening the GPT or the Google Sites page was not the step that installed the RAT.

The critical moment came when the victim executed the command supplied by the fake CAPTCHA and allowed the chain to continue.

So if someone only viewed the page and closed it without running commands or installing files, the documented mechanism would not have reached the installation stage.

If the command was executed, the response should be different: isolate the machine, review persistence and running processes, inspect the indicators published by the security vendor, and treat the system as potentially compromised.

The larger lesson for AI platforms

As ChatGPT, Claude, and other platforms support shared GPTs, agents, artifacts, plugins, and apps, they increasingly resemble small software ecosystems.

That changes the threat model.

Users can no longer ask only:

“Am I on the right website?”

They also need to ask:

“Who created this resource inside the website?”

and:

“What is this resource asking me to do outside the platform?”

That second layer of verification becomes especially important as agents gain access to browsers, files, terminals, credentials, and external systems.

Conclusion

The “Plus 5.6” campaign does not show that ChatGPT was hacked. It illustrates something more useful for understanding the next phase of AI security: a legitimate platform can become part of a malicious operation even when its core infrastructure has not been compromised.

The attackers stacked three layers of trust:

ChatGPT
   +
Google Sites
   +
a familiar fake CAPTCHA
   =
a believable social-engineering chain

The defense is no longer just checking the domain.

It is checking who created the content, where the next link takes you, and what actions the content is trying to make you execute on your own machine.

Sources