Fake ChatGPT Model on Real chatgpt.com Delivers 8-Stage RAT via ClickFix

Threat actors have planted a fake ChatGPT model on OpenAI's own chatgpt.com domain and used it to lure Windows users into installing a sophisticated remote access trojan — no spoofed URL, no lookalike site, and no compromise of OpenAI's systems required. The campaign, uncovered by managed detection and response firm Huntress, marks the first confirmed abuse of Custom GPT as a social-engineering delivery mechanism — and within 48 hours of OpenAI removing the first malicious model, an identical second variant went live.Fake "Plus 5.6" Lures Victims From Google SearchThe attack begins with a sponsored Google Search result. Users who search for "chatgpt" see a paid advertisement that directs them to a Custom GPT page hosted on the legitimate chatgpt.com domain.