Malicious Custom GPTs Weaponize ChatGPT and Google Domains in ClickFix RAT Campaign — Detection and Hardening Guide

---
title: ClickFix - Run Dialog Spawning Script Interpreter with URL
id: 3f8c1a72-6b4d-4e91-a2c7-9d0e5f6a7b8c
status: experimental
description: Detects Windows Run dialog (explorer.exe) spawning mshta, powershell, or similar interpreters with an HTTP(S) URL in the command line — the hallmark of ClickFix paste-and-run lures, including the malicious custom GPT campaign abusing OpenAI/Google domains.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/malicious-custom-gpts-chatgpt-rat-delivery-lure
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_interpreter:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  selection_url:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  condition: all of selection_*
falsepositives:
  - Rare legitimate admin workflows launching scripts by URL from the Run dialog — tune by known admin accounts/hosts
level: high
---
title: ClickFix - PowerShell Download Cradle with Hidden Window
id: 8a2e5d41-1c3f-4b68-9a0d-2e7c4f8b1a35
status: experimental
description: Detects PowerShell download cradles (IEX/DownloadString/Invoke-WebRequest) launched with hidden window flags, consistent with ClickFix second-stage payload retrieval and RAT delivery.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/malicious-custom-gpts-chatgpt-rat-delivery-lure
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_cradle:
    CommandLine|contains:
      - 'DownloadString'
      - 'DownloadFile'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'iwr '
      - 'irm '
      - 'curl.exe'
      - 'Start-BitsTransfer'
  selection_exec:
    CommandLine|contains:
      - 'IEX'
      - 'Invoke-Expression'
      - 'IEX('
      - 'iex('
      - '| iex'
      - '-enc'
      - '-e '
      - 'FromBase64String'
  selection_stealth:
    CommandLine|contains:
      - '-w hidden'
      - '-WindowStyle Hidden'
      - '-win hidden'
      - '-nop'
  condition: selection_cradle and (selection_exec or selection_stealth)
falsepositives:
  - Software deployment tooling using scripted downloads — allowlist known management servers and deployment accounts
level: high
---
title: ClickFix - Script Interpreter Executing from User Temp or AppData
id: c47b9e03-5d2a-4f18-b6e3-8a1d0c4f7e92
status: experimental
description: Detects script interpreters or LOLBins executing payloads dropped into user-writable temp/AppData paths, a common staging location for ClickFix-delivered RATs.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/malicious-custom-gpts-chatgpt-rat-delivery-lure
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '%TEMP%'
      - '%APPDATA%'
  selection_exec:
    Image|endswith:
      - '\powershell.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_dropbox_updaters:
    CommandLine|contains:
      - '\AppData\Local\Microsoft\'
      - 'WindowsUpdate'
  condition: selection_path and selection_exec and not filter_dropbox_updaters
falsepositives:
  - Some legitimate installers and updaters execute from AppData — maintain a tuned allowlist of signed updater command lines
level: medium

let Lookback = 14d;
let Interpreters = dynamic(["mshta.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe"]);
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where FileName in~ (Interpreters)
| where InitiatingProcessFileName =~ "explorer.exe"
| where ProcessCommandLine has_any ("http://", "https://")
   or (ProcessCommandLine has_any ("DownloadString", "DownloadFile", "Invoke-WebRequest", "irm ", "iwr ", "IEX", "FromBase64String", "Start-BitsTransfer")
       and ProcessCommandLine has_any ("-w hidden", "-WindowStyle Hidden", "-nop", "-enc", " -e "))
   or ProcessCommandLine has_any ("\\AppData\\Local\\Temp\\", "\\Users\\Public\\", "%TEMP%", "%APPDATA%")
| extend SuspicionScore = case(
    InitiatingProcessFileName =~ "explorer.exe" and ProcessCommandLine has "http", 3,
    ProcessCommandLine has_all ("hidden", "IEX"), 2,
    1)
| summarize Commands = make_set(ProcessCommandLine, 5), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, AccountName, FileName, SuspicionScore
| order by SuspicionScore desc, LastSeen desc

-- Hunt for ClickFix-style execution: script interpreters with URL/cradle
-- command lines, and suspicious Run-key persistence in user hives.
LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(mshta|powershell|pwsh|wscript|cscript|rundll32)'
  AND (
    CommandLine =~ '(?i)https?://'
    OR CommandLine =~ '(?i)(DownloadString|Invoke-Expression|IEX|FromBase64String|-w(hidden)?\s+hidden|WindowStyle\s+Hidden)'
    OR CommandLine =~ '(?i)(\\AppData\\Local\\Temp\\|\\Users\\Public\\|%TEMP%|%APPDATA%)'
  )

LET runkeys = SELECT FullPath, Name,
  Data.value AS Value
FROM glob(globs='HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*\\*',
          accessor='registry')
WHERE Value =~ '(?i)(powershell|mshta|wscript|rundll32|\\AppData\\|\\Temp\\|%APPDATA%|%TEMP%)'

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'RUNKEY_PERSISTENCE' AS Name,
       FullPath AS Exe, Value AS CommandLine, NULL AS Username, NULL AS CreateTime
FROM runkeys

# ClickFix Hardening & Triage Script - Security Arsenal
# Run elevated. Review outputs before enforcing firewall rules in production.

# 1) Enable PowerShell Script Block Logging (surfaces decoded cradle content)
$sblPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
if (-not (Test-Path $sblPath)) { New-Item -Path $sblPath -Force | Out-Null }
Set-ItemProperty -Path $sblPath -Name 'EnableScriptBlockLogging' -Value 1 -Type DWord
Write-Host '[+] PowerShell Script Block Logging enabled' -ForegroundColor Green

# 2) Enable command-line capture in process creation events (Event ID 4688)
$auditPath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit'
if (-not (Test-Path $auditPath)) { New-Item -Path $auditPath -Force | Out-Null }
Set-ItemProperty -Path $auditPath -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1 -Type DWord
auditpol /set /subcategory:"Process Creation" /success:enable | Out-Null
Write-Host '[+] Process creation command-line auditing enabled' -ForegroundColor Green

# 3) Triage: dump RunMRU (Run dialog history) for all user profiles - look for pasted ClickFix commands
Write-Host '[*] Run dialog history (RunMRU) - review for mshta/powershell/URL entries:' -ForegroundColor Cyan
Get-ChildItem 'HKU:\' -ErrorAction SilentlyContinue |
  Where-Object { $_.PSChildName -match '^S-1-5-21' } |
  ForEach-Object {
    $mru = "Registry::$_\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
    if (Test-Path $mru) {
      Get-ItemProperty $mru | Select-Object -Property * |
        Out-String | Write-Host
    }
  }

# 4) Mitigation: block mshta.exe outbound (uncomment to enforce after testing)
# New-NetFirewallRule -DisplayName 'Block mshta.exe Outbound (ClickFix mitigation)' `
#   -Direction Outbound -Program "$env:SystemRoot\System32\mshta.exe" -Action Block
# New-NetFirewallRule -DisplayName 'Block mshta.exe Outbound x86 (ClickFix mitigation)' `
#   -Direction Outbound -Program "$env:SystemRoot\SysWOW64\mshta.exe" -Action Block

# 5) Check whether WDAC/AppLocker policy constrains script interpreters for standard users
$ci = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
if ($ci -and $ci.CodeIntegrityPolicyEnforcementStatus -eq 0) {
  Write-Host '[!] WDAC not enforced - consider an AppLocker/WDAC policy restricting mshta, wscript, cscript for standard users' -ForegroundColor Yellow
}

Write-Host '[*] Complete. Forward Script Block logs (Event ID 4104) and 4688 events to your SIEM.' -ForegroundColor Green