The trick is dull, which is why it works. Somebody builds a Custom GPT, gives it a name that looks like a model release, and lets it say the one thing an impatient person wants to hear: the real service is busy, use this mirror. According to Help Net Security, the "Service Availability Notice" in the Plus 5.6 GPT says exactly that, and the mirror is a Google Sites page dressed up as a Cloudflare CAPTCHA.
Where the traffic came from
BleepingComputer reports that sponsored Google results were pushing people to the GPT in the first place. So the chain runs: paid search result, a genuine chatgpt.com address, a genuine Google Sites address, then a human being who has been walked through three trusted-looking hosts and is ready to follow an instruction. Nothing in that path trips a reputation filter.
The payload is the elaborate part
The Huntress write-up counts eight hops between the pasted command and the final implant. There is an MSI that sideloads through a legitimately signed Canon executable, a loader hidden in a WAV file where encrypted shellcode replaces real audio, and a remote access trojan unpacked from an archive of 806 files. Once running it offers remote desktop, camera and microphone capture, file search and the ability to run further payloads. Huntress says its SOC responded to at least 40 incidents from the Google Sites domain, with two confirmed as arriving through a Custom GPT. SecurityWeek covers the same campaign.
Why staff will not spot it
Most awareness training teaches people to distrust unknown domains and odd attachments. This one uses no attachment, and the domains belong to Google and OpenAI. The only step that is wrong is the last one, where a webpage asks you to open Run or Terminal and paste something. Huntress puts it plainly: no legitimate website, CAPTCHA or fix will ever ask for that.
- Restrict the Run dialog, PowerShell and Terminal for standard users where the job does not need them; this single control breaks the whole chain.
- Add "a page told me to paste a command" to phishing training as its own scenario, with the ChatGPT variant named.
- Decide whether Custom GPTs from unknown publishers are allowed on corporate ChatGPT accounts, and write that down.
- Hunt for an MSI launching a signed Canon binary, and for unexpected process trees under explorer.exe and terminal hosts.
- Assume takedowns are temporary; block on behaviour, not on the specific GPT name.
If you want a second pair of eyes on your endpoint restrictions or user awareness programme, email sales@halfteck.com.