A New Wave of RATs Spreads via Abused ChatGPT Custom GPTs, Exposing Users to ClickFix Lures
Malicious actors have discovered a novel way to spread Remote Access Trojans (RATs) using compromised ChatGPT custom models. These attackers are exploiting vulnerabilities in the popular AI chatbot platform to deliver RATs through carefully crafted “clickfix” lures. This development has significant implications for users of ChatGPT and its parent company, OpenAI.
The attack vector involves creating a custom GPT model within the ChatGPT platform that appears legitimate but actually harbors malicious code. When a user interacts with this compromised model, they may be prompted to download a seemingly innocuous file or click on a link. However, behind the scenes, the RAT is secretly installed on their device, allowing attackers to gain unauthorized access and control over the system.
OpenAI’s ChatGPT has gained immense popularity for its ability to generate human-like responses to user queries. The platform utilizes a complex network of custom GPT models that are trained on vast amounts of data to provide accurate and context-specific answers. However, this same architecture has proven vulnerable to abuse by malicious actors seeking to exploit the platform’s capabilities.
The implications of these attacks extend beyond individual users, as compromised devices can become part of larger botnets used for coordinated cyberattacks or distributed denial-of-service (DDoS) campaigns. Furthermore, RATs often come with advanced features that enable attackers to harvest sensitive information, such as login credentials, financial data, and personal identifiable information.
The surge in RAT attacks via ChatGPT custom GPTs highlights the need for users to exercise extreme caution when interacting with unfamiliar or unsolicited models within the platform. It is essential to be aware of the potential risks associated with engaging with AI-powered chatbots, especially those that seem too good (or offer solutions) to be true.
To minimize exposure to these types of attacks, we recommend being cautious when downloading files or clicking on links from unknown sources within ChatGPT. Users should also regularly update their operating systems and security software to ensure they have the latest patches and protections in place.
Source: The Hacker News — 2026-09-30