Advertising campaign with fake ChatGPT pages distributed NetSupport RAT through ClickFix — 01.10.2026

Attackers used Google-sponsored search results and attacker-authored ChatGPT content to route people to a fake ChatGPT and Cloudflare verification page. ClickFix instructions prompted Windows users to execute a PowerShell command that retrieved a malicious loader. Isolated analysis identified behavior consistent with NetSupport RAT delivery.