- Attackers are abusing shared AI chats, custom GPTs and fake install pages to make malware look legit.
- One malicious custom GPT had more than 10,000 conversations when Push Security found it.
- Users are advised to never paste a command from a page found through a search ad.
Criminals have found a new way to get people to infect their own computers. They hide behind the names of ChatGPT and Claude. Security firm Push Security described the trend in a September 23 report.
Another October 21 Push Security-sponsored publication throws more light on the attack. It describes how ClickFix is fast becoming a go-to technique that hackers are using to spread malware.
The lures have gotten more advanced and targeted, with recent campaigns targeting legitimate generative AI tools users to make them appear less suspicious.
What ClickFix is and How It Works
ClickFix is a trick that makes you run the attack yourself. A page claims something is broken. It then tells you to copy a command and paste it into your computer. Once you do, the malware starts. Much of the attack runs in memory and leaves no file for security tools to scan.
In fact, the method has grown fast. Push says ClickFix made up an average of 52% of its detections through the second quarter of 2026. In August, that share reached 67%. Push also cites Microsoft data showing that 96.3% of ClickFix intrusions end in malware.
Search ads drive much of this. Push says four in five ClickFix pages it intercepted in 2026 came from search results. Because email filters never see those pages, they cannot stop them.
The Custom GPT with 10,000 Conversations
A custom GPT is a tailored version of ChatGPT. Anyone with a paid account can build and share one. Push found one that answered with a fake “Service Availability Notice.” That notice linked to a Google Sites page that served a Windows ClickFix attack. Push says the GPT had more than 10,000 conversations when it saw it.
The GPT lives on chatgpt.com, so it looks legitimate. The victim must also send a message first, so the visit feels like normal use. Only then does the fake outage message appear.
Push says this continues a campaign that Huntress and the security firm Island reported earlier. Push’s indicator list shows the GPT’s web address ends in “plus-5-6,” the name Huntress reported.
Huntress said that GPT reached victims through a sponsored Google result for “chatgpt.” The firm linked at least 40 incidents to the Google Sites page. It confirmed that two began with a custom GPT.
OpenAI removed the first GPT Huntress found by September 25. Two days later, Huntress found a second one. However, Push did not say whether OpenAI had removed the GPT it saw. Huntress’s malware was a remote access trojan. It lets criminals control the computer, capture audio and camera feeds, and search files.
Two Traps Aimed at Claude Users
The first trap starts with a Google ad. Push saw a search for “claude mac” return an ad that showed bing.com as its address. The click passed through Bing and a retail website that appears to be hacked. It ended on a fake “Download Claude” page. Visitors who skip the ad, however, see a harmless page or an error.
The fake page shows Anthropic’s real install command. However, the copy button grabs a different one. The hidden command prints a real claude.ai address in Terminal. Then it fetches a script from another site and runs it without saving it. A careful user sees Anthropic’s name at every step. Push says the command targets Macs.
Separately, ChatGPT’s direct access to Mac Messages has raised privacy and security concerns about how AI tools interact with users’ personal data.
The second trap uses shared Claude chats. Zscaler found chats posing as Apple Support that told Mac users to run commands. Those commands then installed MacSync Stealer, a program that steals data. Push’s May 29 report described both ChatGPT and Claude versions of this scheme, which it calls LLMshare.
Why AI Tools Make the Perfect Bait
Two main habits are driving this trend, and honestly, they’re making life a whole lot easier for the bad guys.
For one thing, getting tools like Claude Code up and running takes very little effort, just one line of text, copy & paste a command, and you’re done. Suddenly, people who may never have even opened up a command window before are grabbing these tools by the handful & using them without giving it a second thought.
And the second thing that’s really kicking this trend into high gear is the fact that most folks are stumbling upon AI tools by searching for them rather than actually knowing what the website URL is.
Push’s article mentions the malware analysis company ANY.RUN, and what they found is pretty shocking. Between April 15 & October 5, they dug up no less than 1,258 public malware cases that were all linked back to fake AI tool campaigns.
And a whopping 81% of those bad things pretended to be Claude, ChatGPT, or Codex. Last quarter, those kinds of attacks only accounted for a paltry 5% of Push’s detections. While that may sound small, it’s still on the rise.
How to Stay Safe
- Open AI tools by typing the web address yourself or using a bookmark—don’t click on sponsored links.
- Any page asking you to paste a command into Terminal, PowerShell, or the Run box is likely a fake; check the official site first before making any move.
- Also, a trusted web address proves little. Anyone can publish a shared chat, and any paid user can build a custom GPT.
- If you already run such a command, disconnect the device and call your IT team.
OpenAI plans to retire custom GPTs on December 11. Even so, shared chats and fake install pages stay open to abuse. The safest thing to do is to never run a command you don’t understand.
