GoKawiilFake 'Plus 5.6' ChatGPT bot used to push malware via ClickFix scam
Security firm Huntress found attackers had built a Custom GPT named 'Plus 5.6' hosted on the real ChatGPT.com domain, designed to look like an official OpenAI model. The bot told users ChatGPT was unavailable and pushed them to a fake Cloudflare security check page that instructed them to copy and paste a Windows command, a technique known as ClickFix, which could install malware capable of accessing files, screens, webcams and microphones. Huntress says some victims reached the fake bot via a sponsored Google ad for 'ChatGPT' placed above organic search results.