Attackers stage a RAT lure on the real chatgpt.com using a Custom GPT

Huntress researchers found attackers abusing ChatGPT's Custom GPT feature as a malware delivery mechanism across at least 40 related incidents.

Huntress said the payload establishes resilient access through dual persistence and DLL sideloading, using a Canon-signed executable and, in a later wave, a Stardock-signed one, and that it confirmed two Custom GPT-driven infections among the incidents.

A victim searches Google for "ChatGPT," clicks a sponsored result, and lands on a Custom GPT page at the real chatgpt.com domain titled "Plus 5.6," designed to look like a new ChatGPT model.

When a program asks for a DLL by name, Windows checks the program's own folder first, so whatever sits next to the EXE with the right name gets loaded. That's DLL sideloading, and it's the door the attackers used.

Canon's binary is genuine and its signature checks out; the attackers replaced its logging library with a modified version that still exports the functions Canon expects but also imports one extra DLL, rdCore.dll, where the malicious code lives, changing only one line in the import table.

The attack uses eight stages, with each stage hiding the next.

The PowerShell command uses a decimal IP address instead of the usual dotted format, which Windows accepts but some URL filters may not recognize.

The PowerShell downloads a 27,000-character script made up of negative numbers that decodes itself in memory, so the readable code is never saved to disk.

It installs an MSI called ISOSimple.msi that pretends to be an "Advanced Printer Configuration Reader" from a publisher called Softplicity and hides itself from the list of installed programs.

The loader opens monitor.raw, a custom encrypted archive containing 315 folders, 806 files, a persistence script, and the final remote access trojan, each file under its own encryption key.

Microsoft Defender detected and quarantined the MSI in at least one case, but by then the malware had already created a Run key and a scheduled task.

Security Affairs described the monitor.raw archive as a homemade encrypted filesystem built to package and deliver the RAT past automated tooling.

rdCore.dll extracts an encrypted loader from a WAV file bundled with the installer; the file begins with real audio and switches to encrypted payload partway through, and its header claims about 700KB while the file is actually over 1MB.

A rolling XOR cipher decodes the loader directly into memory.

The WAV file's declared size understates it by more than 300KB, the space that holds the hidden payload.