Malicious ChatGPT Custom GPTs lead to ClickFix attack

Two malicious Custom GPTs within ChatGPT were used to direct victims to a ClickFix website that spread remote access trojan (RAT) malware, Huntress reported Monday.

At least 40 victims were impacted by the ClickFix attack, with two intrusions confirmed to have originated from the Custom GPT lure. Custom GPTs are versions of ChatGPT personalized with their own instructions, knowledge files and tools, and users can access Custom GPTs made by others through the ChatGPT website.

Huntress found that victims were brought to the Custom GPT called Plus 5.6 through a Google Ad that displayed its link at the top of search results for “chatgpt.” This link brought users to a conversation with the Custom GPT hosted on the real ChatGPT website.

The Custom GPT was set up to respond to any prompt with a message saying the primary ChatGPT domain was experiencing availability issues and that the user could visit a backup domain to continue using the service, which led victims to a malicious website hosted on Google Sites.

This website displayed a fake Cloudflare CAPTCHA with ClickFix instructions, telling the user to copy and paste a command into their Windows Terminal.

Executing this command set off an eight-stage attack chain that culminated in the execution of the RAT malware. The initial command runs a heavily obfuscated script that installs and launches an MSI called “ISOSimple.msi,” which serves as an installer for the next DLL-sideloading stage.

ISOSimle.msi sideloads ceiinfolog.dll into the legitimate signed Canon executable COTFileReadApp.exe. While ceiinfolog.dll is a real Canon DLL, this version was modified to load another malicious DLL, rdCore.dll, which extracts a malicious loader from a .wav file embedded in the installer. Two helper DLLs – WPFLocalizeExtension.dll and WMPCL.dll – assist in this extraction process.

The decoded bytes from the .wav file form raw x64 shellcode that performs an Antimalware Scan Interface (AMSI) bypass, ntdll unhooking to evade EDR monitoring hooks and anti-VM checks. It also displays a fake loading window to distract the user and hosts the .NET runtime to run .NET code straight from memory, but its main goal is to locate a file called monitor.raw, an encrypted archive that delivers the final payload and persistence scripts.

The monitor.raw file is described by Huntress as “an entire encrypted file system” and a “homemade, encrypted zip file” with a folder tree totaling 315 folders and 806 files. One of these files delivers a persistence mechanism that writes an HKCU Run key named “Canon Configuration Reader,” checks for the run key every 150 seconds and replaces it if it’s gone, and writes the key again every time Windows shuts down. It also creates a scheduled task with the same name and runs a check every 875 seconds to replace the task if it is removed.

The file also pulls a resource called @input, which is the final RAT payload, and runs it in memory. The RAT enables the attacker to run remote desktop sessions, view a broadcast of the victim’s screen and capture camera, microphone and system audio inputs. It is also able to launch the user’s default browser, supporting a total of 17 different browsers, has a built-in file manager with advanced search capabilities and can drop and run additional payloads, supporting EXE, DLL, MSI, PowerShell, Batch, VBScript, JScript and ZIP file formats.

When it is first run, the malware collects detailed information about the host machine, including installed antivirus products, domain and domain controller details, open ports, network adapters, installed software, activated Windows features, Microsoft Defender status and a detailed hardware fingerprint.

The RAT uses DNS-over-HTTPS via Cloudflare, Google and Quad9 servers to reach its C2 server, however, the C2 address was never recovered, with the researchers hypothesizing it was hidden in an encrypted configuration, delivered at runtime or was hidden somewhere deep within the code. Multiple obfuscation, encoding and encryption methods were noted to be used across the eight-stage attack chain, including integer arrays, XOR encryption and runtime string decryption.  

Huntress reached out to OpenAI to have the malicious Custom GPT taken down; however, a second Custom GPT from the same campaign was later discovered, using the same Plus 5.6 name. This version led to the same RAT payload but with some differences in the attack chain; for example, the EXE used for DLL sideloading was changed from the Canon executable to Stardock’s DeElevate64.exe with a modified version of Stardock’s DeElevator64.dll replacing ceiinfolog.dll. The new version also hid a loader in the real Microsoft NuGet package Build.dat instead of a .wav file.

As of Tuesday afternoon, both malicious Custom GPTs appeared to have been taken down by OpenAI. Huntress noted that the delivery server for the campaign hosts another installer called UltraFreeISOCreateWizardSolution.msi, warning that it’s likely future attacks will continues to use different signed applications to deliver the malware.

To detect this attack, Huntress recommends focusing on process activity, as most of the attack chain runs in memory. Detection opportunities include the ISOSimple.msi process being launched by powershell.exe, COTFileReadApp.exe or DeElevate64.exe running from %LOCALAPPDATA%\Programs\ and HKCU Run values and scheduled tasks named Canon Configuration Reader or Stardock DeElevation Tool. Defenders can also look for the DLLs ceiinfolog.dll, rdCore.dll, WPFLocalizeExtension.dll and WMPCL.dll stored in the same folder as COTFileReadApp.exe.

In general, Huntress noted that PowerShell launching msiexec on a GUID-named MSI in %TEMP%, a signed app started by msiexec from a fake product folder in %LOCALAPPDATA%\Programs\ and Run values and scheduled tasks that share the same name and reappear after deletion can be regarded as suspicious regardless of the specific signed application being abused.