TL;DR: Huntress found a malicious ChatGPT Custom GPT, named to pass as an official model, that told visitors the service had moved to a backup domain. That domain was a Google Sites page dressed as a Cloudflare check, and it talked people into pasting a command that ended in a remote access trojan. The address-bar check your staff were taught did not help, because both addresses were real.
Updated October 23, 2026: SC Media reported both malicious Custom GPTs appeared to be down by September 29, but Huntress reported on October 14 that organizations were still being hit as the attackers moved to new Google Sites pages and a domain of their own. OpenAI plans to retire custom GPTs on December 11, 2026.
Which domain was the fake one?
Neither. That is the whole story.
Huntress documented the chain on September 28, 2026. In that chain the attacker registered no lookalike domain. They published a Custom GPT, which OpenAI hosts under its own domain, and named it so it read as an official ChatGPT model. A sponsored Google result for "chatgpt" led some victims to it. Whatever a visitor typed into the GPT, it answered with a single canned "Service Availability Notice": limited availability on the primary domain, continue through our backup domain.
The backup domain was a Google Sites page impersonating a Cloudflare CAPTCHA. That is where the paste instruction lived: when the command went onto the clipboard the address bar read sites.google.com, and one step earlier it read chatgpt.com.
What followed was an eight-stage chain: PowerShell, an MSI dropped into the temp folder, then a malicious DLL sideloaded into a signed, legitimate executable. Huntress saw two versions, one riding a Canon binary and one riding a Stardock binary, carrying an identical payload.
Huntress responded to at least 40 incidents traced to that one Google Sites page, and confirmed two came through a Custom GPT.
Key takeaway: A check for a familiar address returned
chatgpt.com, thensites.google.com. Both familiar, both genuine. But the second is a Google Sites page claiming to be a Cloudflare check, and Cloudflare does not serve its checks from Google Sites. That mismatch is the tell.
What is ClickFix?
ClickFix is any page that persuades you to copy something and run it yourself. It shows a CAPTCHA, a browser error or a verification step, quietly loads a command onto your clipboard, and tells you to paste it into the Run dialog, Windows Terminal or PowerShell. Microsoft's security researchers documented the page script copying the command to the clipboard, and named the usual costumes: fake CAPTCHAs, impersonated Cloudflare Turnstile pages, spoofed Discord servers.
In early 2025, Microsoft Defender Experts observed thousands of devices per month where a user had run a ClickFix command, even with an endpoint detection and response solution enabled.
ESET's H1 2026 Threat Report records that "ESET detections of this vector more than doubled between H2 2025 and H1 2026, indicating sustained activity and adaptation."
Who in a High Point plant is exposed?
Huntress publishes no victimology, so what follows is a risk model, not a finding.
In some of the incidents Huntress investigated, the victim reached the Custom GPT through a sponsored Google result for "chatgpt". That points at whoever searches for an AI tool by name instead of using a bookmark. In a plant, that profile fits an estimator, a controller or a scheduler sooner than anyone in IT. Those job titles sit in shops from High Point and Thomasville to Kernersville, Greensboro and Winston-Salem.
We covered the policy side in our shadow AI training-gap guide, and the fake-tool side in the Kaspersky fake AI tools analysis.
That second post needs a correction in light of this campaign, and it is ours to make. Its defense was a sanctioned tool catalog plus DNS filtering plus application allow-listing. The catalog and the DNS filter do not address this path, because both domains were genuine and one of them was the sanctioned tool itself. Its allow-listing rule misses it too: that post says to block "any executable downloaded by a browser into Downloads", and this chain never touches Downloads. PowerShell runs msiexec on an MSI in the temp folder, and a signed EXE then runs from a fake product folder under %LOCALAPPDATA%\Programs\. What catches it is default-deny, or MSI rules plus path rules for user-writable folders such as %TEMP% and %LOCALAPPDATA%, with DLL rules enforced. A blanket %LOCALAPPDATA% deny breaks OneDrive and other per-user apps, so it needs a tested exception list. A publisher rule that trusts Canon or Stardock would let the host run, because those binaries are validly signed. The DLLs they load are not trustworthy: in the Canon chain Huntress lists them as "Malicious, unsigned" and the patched Canon DLL as "Signature stripped", and in the Stardock chain DeElevator64.dll was "patched the same way" and its "header checksum no longer matches".
Not sure who at your company is searching their way to AI tools? Call Preferred Data Corporation at (336) 886-3282.
What actually stops it, ranked by what it costs you
| Control | Effort | What it does against this attack |
|---|---|---|
| Teach one rule: never paste a command unless IT sent it for your ticket | An hour | Targets the step every ClickFix variant needs: a person pasting the command |
| Publish real bookmarks for approved AI tools | One email | Reduces how many people reach an AI tool through a search result at all |
| Remove the Run dialog for office staff via Intune or Group Policy | An afternoon, plus an exception list | Closes the Run dialog path only. This campaign's lure said to use Terminal |
| Application allow-listing (Defender Application Control, ThreatLocker) | Weeks, with real tuning cost | Can block the stage after the paste with default-deny, or MSI and user-writable path rules plus DLL rules |
| Constrain PowerShell for users with no reason to script | Days, and it will break things | Removes the common first stage, not the chain. Check your RMM agent, login scripts and any vendor dial-in first |
| Contain the machine, rotate every account signed in or saved on it from a clean device, remove added MFA and mail rules, check other hosts, reimage | Hours per machine | What to do once a command has run. Rotating passwords alone leaves the RAT and its persistence in place |
| EDR alone | Already purchased | Varies by product and tuning. Microsoft's own data shows users completing the paste on EDR-protected devices |
Treat a pasted command as an incident, in this order. Contain the machine: use EDR network containment if you have it and can reach IT within minutes, because pulling the cable also cuts the EDR off; otherwise pull the cable and turn off Wi-Fi first, and leave it powered on. From a different, clean device, rotate every account signed in or saved on that machine and revoke its sessions: browser-saved passwords, Microsoft 365 and single sign-on sessions, VPN, any password manager that was unlocked, and any admin who signed in to help. At the same time as each password reset, remove any MFA methods the attacker added, then any inbox or forwarding rules and app consents. If anyone used online banking on that machine, call the bank. Check other hosts, because Huntress records the RAT taking stock of "Domain and domain controller details". Then reimage. Microsoft's incident response guidance covers the device half: "Isolate the endpoint and contact the user or IT operations/helpdesk to initiate a reinstallation procedure." Our managed cybersecurity and managed IT teams across the Piedmont Triad can run it with you.
Huntress documents remote desktop, screen broadcasting, camera and microphone capture, a file manager that searches file contents across the whole host, the ability to deploy further payloads, and a Run key and scheduled task that it re-creates if deleted. It does not document a credential stealer in this chain. With remote control of the desktop and the files, the attacker can reach whatever was signed in or saved there without anyone typing, which is why rotation covers every account on the machine and happens from a clean device. A tool that can push a second payload and restore its own persistence is why a single paste in Lexington ends in a reimage, not a cleanup.
Does OpenAI removing it solve the problem?
No, and what happened next makes the case. Huntress reports the first Custom GPT, which it had flagged to OpenAI, was taken down as of September 25, and its researchers found a replacement on September 27, still active when Huntress published. Help Net Security found that second GPT still online on September 29 but no longer pointing at the lure, and SC Media reported that by that afternoon both "appeared to have been taken down by OpenAI."
The attack outlived both. In an update dated October 14, Huntress wrote that "we continue to see organizations impacted by this attack vector," with the attackers moving to newer Google Sites pages and to a malicious domain of their own that also serves a ClickFix lure. OpenAI's retirement FAQ says custom GPTs are scheduled to retire on December 11, 2026 (February 11, 2027 for Enterprise workspaces with an approved deferral), when they "and their GPT pages become inaccessible."
A takedown ends a URL, and retiring a feature closes one front door. Neither ends the technique: the paste instruction always lived on the page the GPT pointed to, and the attacker kept that part. For a 70-person manufacturer in Davidson County, "we will hear about it when it gets taken down" is not a plan, because the version that reaches your estimator is the one nobody has reported yet.
What should you do first?
Five things, in the order a plant with one IT person can do them.
- Say the rule out loud, and post it. Email covers your office, not the floor, so put it by the clock and say it at Monday startup: never paste a command from a web page, a chat or an AI answer into Run, Terminal or PowerShell. The only exception is a command IT sent you for a ticket you raised. A support article, a helpful chatbot or a "backup site" you clicked through to on purpose does not count.
- Say the second half too, because it is the half that pays. If you already pasted something and your company has EDR network containment, call IT from another device right away so they can contain it. If it does not, or you cannot reach anyone within a few minutes, pull the network cable and turn off Wi-Fi (airplane mode) first, then call. Leave it powered on and do not type passwords on it. Today is cheap. Friday is not.
- Publish the bookmarks. People will still search, so this narrows the path rather than closing it.
- Hand your IT person the detection question. Ask whoever holds your endpoint tooling to show you PowerShell spawning
msiexecagainst an MSI in the temp folder. Huntress documents the MSI landing as 32 hex characters followed by_ISOSimple.msi, or_IconEdit2Turb.msiin version two, so hunt the process pattern rather than one file name. Then ask for signed applications running from fake product folders under%LOCALAPPDATA%\Programs\, and for Run keys and scheduled tasks sharing a name that reappear after deletion. Huntress also saw a signedGOMCam2024.exein%LOCALAPPDATA%\AppstorageFile\launchingchrome.exewith a throwaway profile under%TEMP%. Without EDR there may be no process history to search unless process-creation auditing (event 4688) was already on, so ask IT or us. - Decide about the Run dialog, and write the exception list first. It closes other variants' path, not this lure's Terminal step. Start with office staff, pilot on a few office machines first, and set a date to review the exceptions.
Preferred Data Corporation has supported manufacturers and industrial firms from High Point since 1987, which is 39 years this year, on site within 200 miles of our office at 1208 Eastchester Drive and remotely for clients across the US and worldwide. We work on AI transformation and AI integration for North Carolina manufacturers.
Want step 4 turned into something your IT person can run? Call (336) 886-3282 or use our contact page and we will send the indicators and policy setting names in writing, no call required.
Frequently Asked Questions
Is ClickFix a virus my antivirus should catch?
It is not a virus, which is the problem. ClickFix is an instruction, and the thing your staff run is a legitimate Windows command. In one incident Huntress saw Microsoft Defender quarantine the MSI, but "By then, the installer had already run."
Was ChatGPT itself hacked?
Huntress describes abuse of a legitimate ChatGPT feature, not a breach. The attacker published a Custom GPT, which OpenAI hosts under its own domain, and the page on chatgpt.com only carried the message pointing at the backup domain.
What if someone already ran the command?
Treat it as an incident. Contain the machine with EDR if you have it and can reach IT within minutes; otherwise pull the cable and turn off Wi-Fi first. Leave it powered on. From a different, clean device, rotate every account signed in or saved on it, including browser-saved passwords, Microsoft 365 sessions, VPN, any unlocked password manager and any admin who signed in to help, and revoke their sessions. Remove attacker-added MFA methods in the same step, then mail rules and app consents, and warn your bank if online banking was used on it. Check other hosts, then reimage. Huntress documents persistence that re-creates itself and the ability to install further payloads, so rotating passwords alone leaves the attacker in place.
Were any North Carolina businesses hit?
Not that we have seen reported. Huntress published no victim geography, industries or job titles, and we are not aware of a named NC victim. The reason to act is exposure, not a local incident.
Would blocking ChatGPT protect us?
From the Custom GPT entry path, yes: with chatgpt.com blocked on the work endpoint, a malicious Custom GPT cannot show the handoff to the Google Sites page. It does not protect you from ClickFix, which Huntress has since seen on new Google Sites pages and a standalone domain, and which also arrives through compromised sites. And it moves usage onto personal phones you cannot see.
Our people are on Macs. Does this apply?
Partly. This campaign delivered a Windows chain, but Microsoft documented a June 2025 macOS campaign using a fake verification page impersonating an internet provider to deliver Atomic macOS Stealer. The same rule covers Terminal on a Mac.