Offer a trusted route
Provide a known link to approved tools and a simple way to question unexpected instructions.
What this does—and does not—establish
Approving a platform does not validate every creator’s content.
AI-themed lureCASE STUDY / Reported by Huntress
Fake AI help led to infections
Huntress traced two infections to deceptive Custom GPTs—user-made ChatGPT assistants.
Source: HuntressObservation reports; exact campaign boundaries unknown.
THE 10-SECOND TAKEAWAY
Check the instruction, not just the address.
HOW IT WORKED
Follow the chain.
Search
→
Ad
→
GPT
SIMPLIFIED VIEW · 1 / 3Warning
→
Outside page
→
False check
SIMPLIFIED VIEW · 2 / 3User action
→
Installation
→
Infection
SIMPLIFIED VIEW · 3 / 3STEP 03
The infection
Following instructions installed malicious software enabling remote control.
HuntressMove through the story at your own pace.
1 / 3
THINK OF IT THIS WAY
Editorial analogy: a convincing notice inside a familiar building can still come from a stranger.
An analogy for the mechanism; not an additional claim about the incident.KEEP THE EVIDENCE IN VIEW
What we know.
What we don’t.
Reported outcomes
At least 40 related incidents; two confirmed through Custom GPTs. Huntress
An October 14 Huntress update reports continued impact and changing lure sites. Huntress
Important limits
Malware capabilities do not prove data theft.
AI-written malware is not established.
A connection to Island’s earlier campaign is unproven.
The lesson beyond
this one case.
Editorial lesson: knowing who owns a website does not tell you who wrote every page or instruction on it.
Where were the people?
Attackers created the lure; users ran commands. Huntress
What happened in response? +
One GPT was removed by September 25; a replacement was found September 27. Huntress
What could help
an organization?
Editorial connections for organizations protecting their own users and devices; these controls do not guarantee prevention.
Connect browsing to device alerts
Investigate suspicious instructions together with browser and endpoint evidence, within authorized monitoring.
What this does—and does not—establish
A visited page is different from executed software. Removing a lure does not clean an infected device.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkTRACE IT TO THE SOURCE
Read the evidence.
Explore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixHuntress · Sep 28, 2026 · Incident response investigation
Read this case’s update history →
Reviewed Oct 15, 2026 · Editorial methodology · Structured data