ChatGPT's Custom GPTs Get Recruited Into a Malware Pyramid Scheme of Fake CAPTCHAs
Ourtake
The chatbot was supposed to answer questions, not ask victims to paste commands to prove they're human.
What happened
Attackers built a malicious CustomGPT called Plus 5.6 that impersonated ChatGPT and was promoted via sponsored Google results. It sent victims to a fake CAPTCHA page using ClickFix techniques that led to a RAT infection. Huntress found at least 40 infections, and OpenAI removed the GPT by September 25, though a new linked CustomGPT has since been found.