Plan
archived
Custom ChatGPTs in sponsored Google ads push ClickFix RAT attacks
- Engineer — Learn: ClickFix via sponsored search ads is a growing delivery vector worth accounting for in endpoint browser controls and employee-facing systems; no specific software to patch here.
- SOC/IR — Plan: Build or tune detections for ClickFix behavioral patterns — clipboard-sourced command execution, mshta or PowerShell spawned from browser context — targeting this ChatGPT-branded lure campaign; no specific IOCs surfaced yet.
- Leader — Learn: Active campaign exploiting employee searches for AI tools via paid ads; reinforces the case for security awareness content on verifying official software sources before downloading.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.