Attackers use Custom GPTs and ClickFix to distribute a RAT

Attackers abused ChatGPT Custom GPTs to impersonate legitimate product offerings and direct victims to a malicious backup site hosted through Google Sites. The site used a ClickFix lure that tricked users into pasting and running a PowerShell command in a terminal. The command downloaded a malicious MSI installer and initiated a multi-stage, obfuscated infection chain ending in a RAT.