Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct victims to malicious sites using ClickFix lures to deliver malware. Huntress observed the activity in late September 2026, marking the abuse of yet another feature in trusted AI platforms. Prior campaigns have weaponized shared links to spread malware.