In late September 2026, threat actors began weaponizing ChatGPT Custom GPTs to deploy remote access trojans and stealer malware. Disguised under the title “Plus 5.6” via Google Ads campaigns, the malicious AI instances redirect users through fake Google Sites CAPTCHA lures to execute multi-stage infection chains involving signed Canon binaries and encrypted WAV audio payloads.
The Anatomy of the Custom GPT Social Engineering Vector
As detailed by Huntress researchers in late September 2026, threat actors have evolved their adversarial AI tactics beyond shared chat threads and Claude Artifacts. They are now leveraging the legitimate Custom GPT feature on ChatGPT.com. These personalized AI models allow users to define custom instructions, upload reference files, and enable specific skills without writing raw code. Attackers purchased sponsored Google search results for terms like “chatgpt,” directing unsuspecting targets straight to these rogue endpoints. The initial URLs carry Google Ads click-tracking parameters to optimize their placement above organic web listings.
The malicious instance discovered by investigators operated under the title “Plus 5.6.” Below this deceptive name, the interface displayed a “community builder” tag—a subtle indicator easily missed by users accustomed to standard AI chatbot interactions. When victims interacted with the prompt window, the Custom GPT responded with a hardcoded “Service Availability Notice.” This script informed targets that primary domain capacity was constrained, nudging them toward a backup Google Sites domain for immediate service.
From Fake CAPTCHA to Multi-Stage DLL Sideloading
Following the prompt’s instructions, victims who navigated to the external Google Sites domain encountered a fabricated Cloudflare CAPTCHA check. This classic ClickFix lure tricked users into copying and executing a malicious PowerShell command directly into their operating system terminal. The script downloaded an MSI installer named “ISOSimple.msi,” initiating a deeply obfuscated execution chain designed to bypass endpoint detection and response systems.
The installer deployed a legitimately signed application from Canon, “COTFileReadApp.exe,” alongside a modified rogue DLL named “ceiinfolog.dll.” This classic DLL sideloading technique forced the legitimate executable to load an unsigned secondary DLL (“rdCore.dll”). That component then extracted an encrypted loader hidden inside an audio file, specifically a WAV file titled “Common.Integrator.Preview.wav.” While steganographic payload delivery via audio and video formats has historical precedent in campaigns like Octowave Loader, its integration into an AI-driven social engineering vector marks a sophisticated escalation.
Before launching the final remote access trojan, the loader shellcode systematically dismantled endpoint defenses. It actively bypassed the Antimalware Scan Interface, unhooked “ntdll.dll” to evade user-mode security monitoring, and executed anti-virtual machine checks by matching CPU vendor strings against QEMU, Xen, Parallels, Hyper-V, VirtualBox, and VMware artifacts. Persistence scripts and the core RAT payload were ultimately unpacked from an encrypted file system named “monitor.raw.”
Capabilities and Command-and-Control Infrastructure
The deployed RAT grants attackers comprehensive control over compromised endpoints. The trojan indexes installed antivirus solutions, tracks Microsoft Defender states, and maps detailed system profiles. It executes live remote desktop sessions, streams screen broadcasts, and captures audio inputs from system microphones and cameras. Furthermore, the malware recognizes seventeen distinct web browsers, automatically launching the default profile to harvest sensitive data. A built-in file manager enables attackers to search file contents across the entire system, as well as drop and execute secondary payloads—including executables, scripts, and DLLs.
To mask its communication channels, the RAT relies on DNS-over-HTTPS routed through Cloudflare, Google, and Quad9 resolvers. Because these lookups travel as standard HTTPS traffic to widely trusted resolvers, they remain entirely invisible within local DNS logs. Operational telemetry from Huntress confirms that at least forty user endpoints were impacted by this campaign infrastructure before OpenAI removed the initial Custom GPT instance on September 25, 2026, though subsequent variants emerged days later.
