# Attackers use Custom GPTs to lure users into malware installation

_Published Wednesday, September 30, 2026 at 2:23 PM EDT · Security, AI · Latest · Tier 2 — Notable_

![Attackers use Custom GPTs to lure users into malware installation — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-E2KBc2Kl1xfsJ_ayeCwrbYODEJELskOif8C_YQFyt7DoGklZczzFD3IetvE9mFBUeQN9SQWCE41WtJA-NkE6dya1xAOznACZzeRCMRhvfSQaGipfmD-z1F2rWFPFGLvYSJwrfKhUrbdzwMc_b4OkpTA8huBozpABL2OBcxCM1cod7Hvr0eH23GgE1sEo/s1700-nu-rw-lo-l85-e365/custom-gpt.jpg)

Attackers used ChatGPT Custom GPTs to direct victims to fake verification pages that installed remote-access malware, Huntress found in late September 2026. The Hacker News reported that no less than 40 users were infected.

Sponsored Google search results led users to an attacker-created GPT named Plus 5.6. It directed them to a Google Sites page posing as a backup service, where a fake Cloudflare check persuaded them to execute a malicious command. The resulting trojan can run remote desktop sessions, capture camera and microphone input, search files and install additional payloads.

## Sources

- [The Hacker News](https://thehackernews.com/2026/09/attackers-abuse-chatgpt-custom-gpts-to.html)

---
Canonical: https://techandbusiness.org/newswire/u_Ddp0nlAEa2v_DINntBJP
Published: 2026-09-30T18:23:17.725Z
Story chronology: 2026-09-30T15:00:15.000Z
Retrieved: 2026-09-30T21:22:22.300Z
Publisher: Tech & Business (techandbusiness.org)