“ChatGPT Told Me to Run This Command”: The Fake ChatGPT ClickFix Trap

Watch the 2-minute video:

You search for ChatGPT, click the first (sponsored) result, and land on chatgpt.com, the real domain. Everything looks right. But the page is a fake Custom GPT, and a few clicks later you paste one line into Terminal that hands your PC to an attacker.

Huntress reported this campaign on September 28, 2026 and updated it on October 14 with new domains. It mixes two things people trust, ChatGPT and “I’m not a robot” checks, into one attack.

How the trap works

The ad. A Google sponsored result for “chatgpt” opens a Custom GPT called “Plus 5.6”, published by a “community builder”, on chatgpt.com.
The fake outage. Whatever you type, it replies with a “Service Availability Notice”: the main service is busy, please continue on a backup domain. That domain is a Google Sites page.
The fake CAPTCHA. The backup page copies a Cloudflare “Verify you are human” check and tells you to copy a code, open Terminal, paste it and press Enter. This trick is called ClickFix.
The payload. The “code” is PowerShell with -ExecutionPolicy Bypass. It downloads a script, silently installs ISOSimple.msi, and hides an app in %LOCALAPPDATA%\Programs\ that doesn’t show in Programs and Features. A legitimately signed Canon program loads malicious DLLs, and the final payload is a remote access trojan (RAT) with remote desktop, screen capture, camera and microphone, browser data (saved passwords), file search, and the ability to install more malware.

Because the first step happens on the real chatgpt.com, the usual “check the address bar” advice doesn’t save you here. OpenAI took down the first GPT, but a second one appeared two days later, and the same fake CAPTCHA page was linked to about 40 incidents.

Rule 1: no real website asks you to paste a command

A real CAPTCHA asks you to click a box or pick pictures. It never asks you to:

press Win + R,
open Terminal, PowerShell or Command Prompt,
paste something (Ctrl + V) and press Enter.

If you see that, it’s a scam. Close the tab. This one rule beats every ClickFix variant, whether the lure is ChatGPT, a fake Windows update, a “fix this error” page or a fake Teams meeting.

Rule 2: go direct

Skip sponsored results for tools you use every day. Type chatgpt.com yourself or use a bookmark. The same goes for your bank, Microsoft 365 and your password manager.

Already pasted it? Check your PC

First, disconnect from the network (unplug the cable or turn off Wi-Fi) so the attacker loses control.

Then open PowerShell and look for the persistence entries Huntress found:

# Scheduled tasks
Get-ScheduledTask | Where-Object TaskName -match 'Canon Configuration Reader|Stardock DeElevation Tool' |
  Select-Object TaskName, State, @{n='Runs';e={$_.Actions.Execute}}

# Run key (starts programs at sign-in)
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'

# Signed apps running from a strange folder
Get-Process | Where-Object { $_.Path -like "$env:LOCALAPPDATA\Programs\*" } | Select-Object Name, Id, Path

The first version uses the name Canon Configuration Reader. The newer one uses Stardock DeElevation Tool. Don’t rely on the names alone: attackers swap them.

The tricky part: it comes back

The malware re-creates the Run value about every 150 seconds and the scheduled task about every 15 minutes. If you delete them while it’s running, they come back. So:

End the process first:

powershell Stop-Process -Name COTFileReadApp, DeElevate64 -Force
Then delete both:

powershell Unregister-ScheduledTask -TaskName 'Canon Configuration Reader' -Confirm:$false Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'Canon Configuration Reader'
Run a full Microsoft Defender scan, then an offline scan (Start-MpScan -ScanType FullScan, Start-MpWDOScan).
Change your passwords from a different, clean device, starting with email, then sign out of all sessions and check your MFA methods. The RAT could read your browser and your keyboard, so anything typed on the infected PC is burned.

In a company, treat it as a security incident. A RAT can install more payloads, so reimaging the PC is the safe choice.

For admins: block it for everyone

1. Defender ASR rule “Block execution of potentially obfuscated scripts” (5beb7efe-fd9a-4556-801d-275e5ffc04cc). Turn it on in Intune (Endpoint security > Attack surface reduction) or GPO. Start in Audit mode for a week if you’re nervous about false positives.

Add-MpPreference -AttackSurfaceReductionRules_Ids 5beb7efe-fd9a-4556-801d-275e5ffc04cc -AttackSurfaceReductionRules_Actions Enabled

2. PowerShell Script Block Logging. GPO: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging. Every script that runs, even decoded ones, lands in event ID 4104, so you can see exactly what a user pasted.

3. Remove the Run box for normal users. GPO: User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run menu from Start Menu. This disables Win + R. Apply it to normal users, not to IT staff.

4. Hunt for the pattern. Huntress suggests alerting when powershell.exe starts msiexec.exe on an MSI in %TEMP%, and when a signed app runs from %LOCALAPPDATA%\Programs\. Don’t block Canon or Stardock software globally: those programs are legitimate, the attackers just abuse them.

5. Tell your users. One short message beats any tool: “No real website will ever ask you to paste a command. If one does, close it and call IT.”

Checklist

[ ] Never paste commands from a website, chat or “CAPTCHA”
[ ] Skip sponsored results; type chatgpt.com or use a bookmark
[ ] Pasted it? Disconnect, check scheduled tasks + Run key
[ ] End the process first, then delete the task and the Run value
[ ] Change passwords from a different device
[ ] Admins: ASR obfuscated-scripts rule, Script Block Logging, no Win + R for normal users

Watch the video:

Sources

Huntress, “Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix” (Sep 28, 2026, updated Oct 14, 2026): https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
BleepingComputer, “Custom ChatGPTs push ClickFix attacks to deploy RAT malware” (Sep 29, 2026): https://www.bleepingcomputer.com/news/security/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/
eSecurity Planet, “Malicious Custom GPTs Lure Windows Users Into ClickFix Malware”: https://www.esecurityplanet.com/news/news-chatgpt-clickfix-malware-windows/
Microsoft, Attack surface reduction rules reference: https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference

Abd Almouhimen Shamout · mouhimen.dev · Take away support: IT fixes, delivered in under two minutes.