IncidentPeople used AI as a toolSeverity M: moderate, 3/5Reported: press reporting only

Fake ChatGPT Custom GPT 'Plus 5.6' lured users into installing a remote-access trojan, Huntress found

Huntress researchers found that threat actors used ChatGPT's Custom GPT feature to build a bot called "Plus 5.6" whose name was chosen to make it look like an official OpenAI product. Victims could reach it through a Google-sponsored link for "ChatGPT". The bot told users ChatGPT was having availability issues and pointed them to a "backup domain". That page showed a fake Cloudflare check on Google Sites that asked them to paste a command into Windows, which installed a remote-access trojan. Huntress investigated at least 40 incidents tied to the Google Sites domain but could confirm only two that began with the malicious Custom GPT. OpenAI reportedly removed one such GPT, and researchers found another linked to the same campaign two days later.

What the AI did

Threat actors used ChatGPT's Custom GPT feature to build a bot called "Plus 5.6" that posed as an official OpenAI product. The bot told users ChatGPT was having availability issues and pointed them to a "backup domain," where a fake Cloudflare check asked them to paste a command into Windows that installed a remote-access trojan, a type of malicious software that lets attackers control a computer from afar.

First reported October 1, 2026 · Added to the register October 4, 2026 · 1 source

Developer: OpenAI
Model: ChatGPT Custom GPT
When it happened: Not stated in the sources
First reported: October 1, 2026

Show the source wording

What this means for you

Could this affect you?

Yes, if your staff use ChatGPT on Windows

ChatGPT users who searched Google for ChatGPT and clicked sponsored links were exposed, especially Windows users willing to paste commands when a page told them to.

What to check

Train staff never to paste commands into Windows because a web page asks them to, even on a trusted site.
Treat unofficial Custom GPTs that claim to be OpenAI products with suspicion.
Watch staff computers for signs of remote-access trojan activity.

Areas of your AI programme this touches

Content and platform moderation Deepfakes and impersonation Consumer protection Third-party and vendor AI

Every fact and its source (6)

Malware installedRemote-access trojan
“Running the command starts a hidden chain that installs a remote-access trojan.”^[1]
Incidents investigatedAt least 40 tied to the Google Sites domain
“Huntress investigated at least 40 incidents tied to the Google Sites domain.”^[1]
Incidents confirmed to start with the Custom GPT2
“It could confirm only two that began with the malicious Custom GPT.”^[1]
ResponseOpenAI reportedly removed one GPT on September 25
“OpenAI reportedly removed one GPT on September 25.”^[1]
Follow-up findingAnother GPT linked to the same campaign was found two days later
“Researchers found another linked to the same campaign two days later.”^[1]
Name of the malicious botPlus 5.6
“The link opened on ChatGPT, the real site, and the bot inside called itself "Plus 5.6."”^[1]

Sources

Report reveals fake ChatGPT model hiding malware
thenews.com.pk · October 1, 2026

How this record is classified. Severity M (3/5): harm to individuals, or a policy breach with limited reach. OECD level: incident, an event in which an AI system led to actual harm. Evidence: Reported, meaning press reporting only.

The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.