A shared custom GPT returned an attacker-authored service-unavailability pretext that referred users to a Google Sites page. The external page then instructed users to open Windows Run and execute a PowerShell downloader that referenced a decimal-encoded numerical address. This chain crosses two distinct trust boundaries: an externally configured assistant…
Inspect the ClaimsCase · DiggingBeagle record
A shared custom GPT directed visitors to a ClickFix malware lure
Push Security observed a shared custom GPT returning a fake service message that sent users to a Google Sites ClickFix page, where a manual command could fetch malicious code.
Scope
Investigative observations published by Push Security in October 2026; the AI-specific element is an attacker-controlled, publicly shared custom GPT used to generate a trusted-looking malicious answer. Malware execution still required a human to follow the lure.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- WITH AI
Basis and provenance
Push Security documented a publicly shared attacker-configured GPT, its fake availability response, a linked Google Sites ClickFix lure and analyzed a downstream PowerShell download command. This supports observation of delivery infrastructure, not a counted set of executed payloads or confirmed endpoint infections.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-LLMSHARE-GPT-FAKE-ERROR · CLM-LLMSHARE-CLICKFIX-STAGE · CLM-LLMSHARE-CONVERSATIONS-NOT-INFECTIONS · Push Security: LLMshare custom GPT and AI-themed malware delivery
At a glance
The entry point is both a marketplace or link-shared AI assistant and the ordinary host-execution chain after leaving it. Platform operators should audit creator-controlled service notices and external recovery links, while endpoint defenses should independently block unexpected PowerShell downloads. A screenshot of more than 10,000 conversations indicates…
Read the implicationsNo confirmed number of users running the downloader or suffering infection is available in the scoped Push Security source. The exact final payload in this campaign cannot be inferred from different but stylistically related Huntress and Island investigations. Identity of all publishing accounts and degree of coordination remain unresolved.
Limits and uncertaintyFull account
A shared custom GPT returned an attacker-authored service-unavailability pretext that referred users to a Google Sites page. The external page then instructed users to open Windows Run and execute a PowerShell downloader that referenced a decimal-encoded numerical address. This chain crosses two distinct trust boundaries: an externally configured assistant presented as conversational help, then a webpage asking a person to authorize a host command. Push Security related the naming and command style to earlier malware delivery clusters, but different previously reported payloads cannot establish the final payload of this particular observed page.
Mechanism and trust boundary
- 01
Visitor opens a shared GPT
The externally created assistant presents itself in the familiar GPT interface.
Boundary: external creator configuration to trusted-looking conversation
- 02
Reply points away from ChatGPT
A fabricated service notice links to a Google Sites page.
Boundary: model answer to third-party web destination
- 03
ClickFix requests local execution
The external page persuades the user to run a PowerShell downloader.
Boundary: web content to human-approved host command
- 04
Remote script is fetched
A decimal-encoded address resolves the download endpoint, but endpoint compromise requires actual execution.
Boundary: host process to attacker-controlled staging
Claims & evidence
CLM-LLMSHARE-CLICKFIX-STAGEPush Security analyzed a Windows ClickFix command that downloaded a remote PowerShell script from a decimal-encoded IP address after a user manually pasted the command into the Run dialog.supported
Basis: reported finding
- supportsPush Security: LLMshare custom GPT and AI-themed malware deliveryprimary disclosure
Links to previously reported campaigns, Push command analysis below PowerShell example
CLM-LLMSHARE-GPT-FAKE-ERRORPush Security observed a shared custom GPT responding to user prompts with a purported service-availability notice linking to a Google Sites ClickFix page.supported
Basis: reported finding
- supportsPush Security: LLMshare custom GPT and AI-themed malware deliveryprimary disclosure
Cluster 2: LLMshare, paragraphs describing scripted GPT replies and associated screenshots
CLM-LLMSHARE-RELATED-CAMPAIGNS-LIMITPush Security connected the naming and command style to earlier Huntress and Island reporting, but those sources described different malware payload chains and do not establish the final payload for every newer GPT lure.supported
Basis: reported finding
- supportsPush Security: LLMshare custom GPT and AI-themed malware deliveryprimary disclosure
Links to previously reported campaigns, Huntress/Island payload comparison
CLM-LLMSHARE-CONVERSATIONS-NOT-INFECTIONSA screenshot of the observed GPT showed more than 10,000 conversations; Push Security did not establish that this represented 10,000 infections or even 10,000 unique people who executed the payload.supported
Basis: reported finding
- supportsPush Security: LLMshare custom GPT and AI-themed malware deliveryprimary disclosure
Cluster 2: LLMshare, caption for 10k+ conversations screenshot
Implications
The entry point is both a marketplace or link-shared AI assistant and the ordinary host-execution chain after leaving it. Platform operators should audit creator-controlled service notices and external recovery links, while endpoint defenses should independently block unexpected PowerShell downloads. A screenshot of more than 10,000 conversations indicates exposure to the assistant, not the number of infections, distinct visitors or successful command executions.
Controls and mitigations
- Warn users that a custom GPT is creator-configured content, not a trusted system maintenance channel.
- Treat instructions to use a terminal, Run dialog or external backup page as untrusted, even when presented inside an AI conversation.
- Monitor risky URL redirections and script-download execution separately from GPT conversation telemetry.
Unknowns and contradictions
- No confirmed number of users running the downloader or suffering infection is available in the scoped Push Security source.
- The exact final payload in this campaign cannot be inferred from different but stylistically related Huntress and Island investigations.
- Identity of all publishing accounts and degree of coordination remain unresolved.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 132