Sponsored ChatGPT Variants Used in ClickFix Attacks to Deploy Remote Access Trojans

Reports indicate that threat actors are leveraging custom ChatGPT variants to manipulate sponsored search placements on Google. When users click these sponsored links, they are redirected to malicious websites that utilize ClickFix attacks. ClickFix is a social engineering technique that tricks users into executing seemingly legitimate commands, often involving PowerShell or HTML applications. Executing these commands results in the infection of the user's system with RAT malware, providing attackers with remote access and control. The campaign highlights the abuse of AI brand trust in search advertising to facilitate malware distribution. As of now, specific victim counts and the exact technical details of the ClickFix chain remain under investigation and have not been independently verified. OpenAI has not issued an official statement regarding the specific campaign, though the company generally advises users to rely on verified channels and exercise caution with search results.