Attackers use Custom GPTs to lure users into malware installation

Attackers used ChatGPT Custom GPTs to direct victims to fake verification pages that installed remote-access malware, Huntress found in late September 2026. The Hacker News reported that no less than 40 users were infected. Sponsored Google search results led users to an attacker-created GPT named Plus 5.6. It directed them to a Google Sites page posing as a backup service, where a fake Cloudflare check persuaded them to execute a malicious command. The resulting trojan can run remote desktop sessions, capture camera and microphone input, search files and install additional payloads.