Fake 'Plus 5.6' on chatgpt.com Is Malware. Here's the Trick

Source: Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix (Huntress) · 2026-10-09; Attackers Combine ChatGPT Feature Abuse With ClickFix to Deliver Trojan Malware (Infosecurity Magazine) · 2026-10-09

How the con works, step by step

1. 1. A sponsored search resultHuntress says that in some incidents, victims searched Google for "chatgpt" and clicked a sponsored result that went to the Custom GPT page. Because it was a paid ad, it appeared above the normal results.
2. 2. A real chatgpt.com addressThe GPT was hosted on chatgpt.com under the name "Plus 5.6". Its builder was shown as a "community builder", not OpenAI.
3. 3. A fake outage noticeEvery reply was the same message. It claimed limited availability and offered two choices: upgrade to Plus, or continue through a "backup domain" hosted on Google Sites.
4. 4. A fake Cloudflare CAPTCHAThe Google Sites page used ChatGPT and Cloudflare branding and asked visitors to paste a command to "verify" they were human. Security researchers call this trick ClickFix.
5. 5. The payloadAccording to Huntress, a PowerShell command downloaded a script that silently installed a malicious MSI. The installer used a signed Canon program to load the malware. It stayed on the PC through a startup (Run) entry and a scheduled task, both named "Canon Configuration Reader". The RAT can take remote control of the desktop, capture the camera and microphone, read browser data, and search files.

Source: Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix (Huntress) · 2026-10-09; Custom ChatGPTs push ClickFix attacks to deploy RAT malware (BleepingComputer) · 2026-10-09

How big is this, and is it gone?

Huntress says its security operations team handled at least 40 incidents connected to the Google Sites lure page. Only two of them were confirmed to have started from a Custom GPT. The rest reached the same trap some other way. Huntress reported the first GPT to OpenAI, and it was taken down as of September 25. On September 27, Huntress found a second "Plus 5.6" GPT tied to the same campaign. That one was still active when Huntress published its write-up on September 28. We could not confirm whether it is still online. BleepingComputer reported no statement from OpenAI about the campaign. Huntress also says later waves swapped the Canon program for a Stardock-signed one, so the persistence name to look for can be "Stardock DeElevation Tool" as well.

Source: Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix (Huntress) · 2026-10-09; Custom ChatGPTs push ClickFix attacks to deploy RAT malware (BleepingComputer) · 2026-10-09

Our take: OpenAI rented scammers its best address

Here's what bothers us most. Security advice has spent years telling people to "check the domain." This scam passes that test, because the first page really is on chatgpt.com. A tiny "community builder" label is weak protection when the GPT's name looks exactly like a model release. And the name was chosen with care. "Plus 5.6" is aimed at the people most eager for the next upgrade: Plus subscribers and people about to subscribe. Pull up the GPT, it tells you to "upgrade or use the backup," and that reads like normal ChatGPT upselling. The takedown worked. The replacement appeared two days later. That isn't moderation. It's a speed bump.

The overrated defense here is blaming the user. Yes, nobody should paste commands into PowerShell. But the attackers stacked three trusted brands in a row: Google ads, OpenAI's domain, and Cloudflare's CAPTCHA style. The underrated fix is boring: OpenAI's own help center says custom GPTs are scheduled to retire on Dec 11, 2026, and be replaced by plugins. If plugins let anyone publish under OpenAI's domain with the same light checks, expect "Plus 5.7" to follow.

For the record: OpenAI's Custom GPT retirement and migration FAQ says the transition affects all ChatGPT plans. It lists Feb 11, 2027 as the later date for Enterprise workspaces with an approved deferral.

Source: Custom GPT retirement and migration FAQ (OpenAI Help Center) · 2026-10-09

Source: OpenAI Terms of Use · 2026-10-09

Why this matters: the terms don't mention GPTs by name, so this isn't a ruling on the "Plus 5.6" GPT itself. But the scam pushes you off chatgpt.com to an outside "backup" page. Our reading is that OpenAI's terms don't make it responsible for third-party services. Being on OpenAI's site doesn't mean the next link is safe.

Source: Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix (Huntress) · 2026-10-09; Attackers Combine ChatGPT Feature Abuse With ClickFix to Deliver Trojan Malware (Infosecurity Magazine) · 2026-10-09

Optional shopping: see a seller listing for ChatGPT plans on SlotPrices. This is a reseller listing, not official OpenAI access, and not an endorsement.. That link carries our partner code Sk52g, which is how a purchase is attributed to this site. Promotion code UPD3S.

ChatGPT · Compare price & terms →