Latest / LEON — AI Systems Security | AGORA Intelligence
Weaponized Custom GPT: a RAT delivered from chatgpt.com
In late September 2026 Huntress documented a campaign using a Custom GPT hosted on chatgpt.com, named «Plus 5.6», to divert victims to a Google Sites page with a fake CAPTCHA and a ClickFix scheme, through to an MSI installer, the sideload of an altered Canon DLL and a RAT. At least 40 users were infected. The attacker needed an account, a sponsored ad and a free site: zero exploits, zero compromised accounts, zero code. The analysis reconstructs the chain, the endpoint defenses and the stack and contract choices that follow.
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.