GoKawiilMalicious custom GPT lures ChatGPT users into ClickFix RAT infection
Huntress researchers found a custom ChatGPT variant named 'Plus 5.6', promoted via sponsored Google search results, that redirects users to a fake Google Sites page mimicking a Cloudflare check. That page instructs visitors to run a PowerShell command which installs a signed application alongside a malicious DLL, deploying a remote access trojan. Huntress says it has investigated at least 40 related incidents, and OpenAI plans to retire the custom GPTs feature on December 11.