If you usually type “ChatGPT” into Google and open the first result to access ChatGPT, a new campaign shows that even this method can be dangerous. Attackers are abusing a custom GPT on the real ChatGPT domain to trick users into ultimately executing a malicious command on their Windows computer.
How does the fake ChatGPT model trick work?
Attackers created a custom GPT named “Plus 5.6”; a name chosen to resemble at first glance one of the official versions of OpenAI’s service. They then used paid Google ads to try to display this fake GPT at the top of results when searching for the term ChatGPT.
What makes this attack more dangerous is the use of the real ChatGPT domain. Because custom GPTs are hosted on the chatgpt.com domain, a user may assume they are dealing with an official and legitimate service and not see an obvious sign of its being fake.
But after entering the fake model, attackers start the next stage of the attack. This GPT tells the user that the main service is experiencing access restrictions and directs them to a “backup domain.”
The second site also creates an appearance similar to legitimate services. That page uses Google services and displays a CAPTCHA resembling Cloudflare examples. It then asks the user, to prove they are human, to copy a command and run it in their Windows environment.
This method is part of attacks known as ClickFix. In this technique, instead of directly installing malware on the victim’s computer, the attacker convinces them to execute a malicious command themselves. As a result, ordinary security warnings may attract less attention, because the main action is performed with the user’s own involvement.
What is the risk of running the command?
According to researchers’ analysis, executing the command provided in this campaign can install a remote access trojan named “@input” on the system. Such malware can allow attackers to control or monitor parts of the victim’s computer.
Among the capabilities attributed to this trojan are viewing the screen, accessing the camera and microphone, inspecting stored files, and installing other malware. Therefore, running an apparently simple command can have consequences far beyond a typical download.
Removing the fake model was not the end of the attack
Cybersecurity company Huntress researchers, after identifying at least 40 incidents related to this campaign, reported the matter on September 28. According to the company’s report, OpenAI had removed the initial fake GPT by September 25, but a nearly identical sample reappeared just two days later.
In a separate investigation by Island, an older and broader version of this campaign was also identified, which ran from late May through August and included hundreds of paid ads and dozens of ChatGPT-like pages.
This shows that merely seeing a legitimate domain or an official-looking page is not sufficient to trust commands displayed on it. Attackers can use legal services and infrastructure to create a chain of pages that ultimately leads the user to malicious content.
On the other hand, OpenAI has announced plans to retire custom GPTs by December; a change that could limit one of the vectors used in this campaign.
However, the most important point for users is simple: no CAPTCHA or legitimate verification process should ask you to enter an unfamiliar command into Windows Command Prompt or Terminal. If a page asking to access ChatGPT makes such a request, executing the command can expose the system to infection.