PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteNo official ChatGPT model called “Plus 5.6” was involved. In a campaign observed in late September 2026, attackers created Custom GPTs on the legitimate ChatGPT site and used them to send visitors to a Google Sites page that posed as a backup service and fake Cloudflare check. The page told people to run a command themselves, starting a malware infection chain. This was abuse of user-created content and trusted hosting—not a vulnerability in ChatGPT, according to Huntress’s investigation.
Was the fake ChatGPT model really on ChatGPT’s website?
Yes, the attacker-created Custom GPT pages were hosted on the real ChatGPT domain. But that did not make them official OpenAI models or safe to use. The campaign took advantage of a distinction that matters on platforms with user-created content: a legitimate website can host pages created by untrusted users.
Huntress reported that sponsored Google search results for “chatgpt” led some users to Custom GPTs named “Plus 5.6.” The GPTs claimed that the primary domain had limited availability and directed visitors to a supposed “backup” page on Google Sites. The page displayed a fake Cloudflare CAPTCHA. These were lures, not genuine ChatGPT service notices or verification steps.
How did the ClickFix scam install malware?
The fake CAPTCHA instructed visitors to copy and run a command. Rather than exploiting a software flaw, this ClickFix technique tries to persuade the user to perform an action that launches the infection. Following the instruction led to PowerShell execution and the download of a malicious MSI installer.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHuntress traced the resulting chain through multiple stages, including DLL sideloading and persistence, to a remote access trojan (RAT) payload. A legitimate vendor signature on an application used in the chain did not make the activity legitimate: attackers abused signed applications as hosts for loading malicious components.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
What changed between the two observed variants?
Huntress described two versions of the chain. The primary difference was the signed application abused as the loading host; the RAT and several underlying components remained the same.
| Observed variant | Abused signed host application | Relationship |
|---|---|---|
| First observed chain | Canon-signed application | Part of the same campaign; not a separate malware family |
| Later observed chain | Stardock-signed application | Changed loading host; RAT and several underlying components remained the same |
These descriptions are based on Huntress’s campaign analysis; they should not be read as evidence that Canon- or Stardock-signed software in general is malicious.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
How many incidents came through a Custom GPT?
Huntress associated at least 40 incidents with the specific Google Sites domain used by the campaign. It confirmed that two incidents originated through a Custom GPT instance. Those figures are different: the 40 incidents were tied to the Google Sites domain, not all confirmed as GPT-origin infections. They reflect Huntress-observed telemetry, not a complete count of victims worldwide.
Huntress reported that it contacted OpenAI, that the first reported GPT had been taken down by September 25, 2026, and that another appeared on September 27. Those dates document what investigators observed then; they do not establish whether any lure or delivery infrastructure is active now. The operator and a complete global victim count were not identified in the reporting.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
What should you do if a page asks you to run a command?
- Do not paste commands from a webpage into Windows Run, PowerShell, a terminal, or another shell just because the page calls the step a CAPTCHA, verification, or access fix.
- Treat unexpected “backup domain” links as untrusted. A service-availability message on a user-created GPT is not proof that the linked destination belongs to the service.
- Check who created a Custom GPT. A page’s presence on the real ChatGPT domain does not establish that OpenAI made or endorses it.
- If you already ran the command, stop interacting with the page and contact your organization’s IT or security team promptly. Tell them what you ran and when; do not assume the absence of an obvious warning means the device is clean.
For security teams, Huntress’s technical campaign report provides behavior details and indicators for investigation. Validate time-sensitive indicators before using them operationally.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why this scam worked
The campaign connected familiar, credible-looking services—a search result, a Custom GPT hosted on ChatGPT, Google Sites, and a Cloudflare-style check—to make the next step seem routine. The key warning sign was not simply the domain shown in the browser; it was the request to execute a command to prove access. Huntress’s conclusion was that attackers continue turning trusted platforms into entry points for social engineering, including ChatGPT Custom GPTs and Google Sites.
Quick Recap
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
