Actor Profile

The threat actors behind this campaign remain unidentified. Their motivation appears to be financially driven, leveraging trusted AI platforms (ChatGPT Custom GPTs) to conduct social engineering attacks that deliver remote access trojans. The campaign demonstrates sophisticated tradecraft, including multi-stage infection chains, advanced evasion techniques, and abuse of legitimate infrastructure (Google Sites, Cloudflare DNS-over-HTTPS) to evade detection. The actors show familiarity with ClickFix social engineering tactics and have successfully infected at least 40 users targeting technology and artificial intelligence sectors.

TTPs (Tactics, Techniques, Procedures)

Initial access via malvertising (T1189) through sponsored Google search results. Social engineering (T1204.001) using fake ChatGPT Custom GPTs and ClickFix lures with fake CAPTCHA checks. User execution (T1204.002) of malicious PowerShell commands (T1059.001) to download MSI installer. DLL side-loading (T1574.002) via legitimate Canon-signed binary. Defense evasion through AMSI bypass (T1562.001), NTDLL unhooking, and anti-VM checks (T1497.001). Steganography (T1027.003) using encrypted payloads hidden in WAV audio files. Persistence mechanisms (T1547) via scripts. C2 communication (T1071.001) using DNS-over-HTTPS through Cloudflare, Google, and Quad9 resolvers to evade local DNS logging. Collection capabilities include screen capture (T1113), audio/video capture (T1125), and credential harvesting from 17 browsers.

Targets & Patterns

The campaign primarily targets users in the technology and artificial intelligence sectors, specifically individuals searching for ChatGPT-related services on Google. Victims are likely professionals or organizations seeking to leverage AI capabilities, making them susceptible to fake Custom GPT offerings. The targeting pattern suggests opportunistic victim selection rather than highly targeted operations, using malvertising to cast a wide net. The abuse of AI platform trust and the technical sophistication of the payload indicate the actors seek high-value targets with access to sensitive corporate data, credentials, and intellectual property. The RAT's extensive capabilities (remote desktop, file search, secondary payload deployment) suggest long-term access objectives for espionage or financial gain.

Historical Context

This campaign represents an escalation in the abuse of trusted AI platforms for malware distribution. Prior campaigns have weaponized shared AI chatbot conversations and malicious Claude Artifacts to distribute stealer malware and RATs. The use of ClickFix social engineering tactics continues a broader trend observed across multiple threat actor groups. The WAV file steganography technique has been previously associated with Octowave Loader campaigns. Concurrent ClickFix campaigns have been observed targeting Ukrainian government systems (attributed to Russia-aligned UAT-10820), using phishing sites mimicking OpenAI Codex and Anthropic Claude, and deploying Amatera Stealer via EtherHiding and ClearFake techniques. The evolution from simple phishing to abusing legitimate AI platform features demonstrates threat actors' adaptation to emerging technologies.

Defensive Recommendations

  • Monitor for PowerShell execution (T1059.001) with suspicious parameters, particularly commands downloading MSI files from external sources. Enable PowerShell script block logging (Event ID 4104) and constrained language mode.
  • Detect DLL side-loading (T1574.002) by monitoring for legitimate signed binaries (e.g., Canon COTFileReadApp.exe, GOMCam2024.exe) loading unexpected DLLs from non-standard directories. Use Sysmon Event ID 7 for image load monitoring.
  • Implement DNS-over-HTTPS traffic inspection or block DoH resolvers at the network perimeter to force DNS queries through monitored channels, preventing C2 communication via Cloudflare, Google, and Quad9 DoH services.
  • Deploy user awareness training focused on ClickFix social engineering tactics, emphasizing that legitimate services never require users to manually copy and execute PowerShell commands from CAPTCHA prompts.
  • Monitor for AMSI bypass attempts (T1562.001) and NTDLL unhooking behavior using EDR telemetry. Alert on processes modifying AMSI.dll or ntdll.dll memory regions, and investigate Chrome launches with temporary profile directories in %TEMP%.