ChatGPT‑Based Malware Attack Targets Small Businesses

What Happened

Huntress researchers have uncovered a new campaign that manipulates Google search results for “ChatGPT.” By pairing the chatbot’s built‑in search feature with a malicious link service known as ClickFix, attackers are able to deliver a Remote Access Trojan (RAT) to unsuspecting users.

When a user types “ChatGPT” into Google, the results list can be altered to display a ClickFix URL that looks legitimate. Clicking the link triggers the download of a PDF that appears innocuous but contains a hidden macro. Once the macro runs, the RAT installs and hands full control of the victim’s computer to the attacker.

The technique is especially concerning for small businesses that rely on AI‑driven tools for customer engagement and support.

Key Details

• Target: Anyone who searches for ChatGPT on Google – including customers, partners, and employees.
• Delivery Mechanism: ClickFix, a known platform that disguises malware as ordinary files.
• Payload: A sophisticated RAT capable of stealing credentials, exfiltrating data, and creating persistent backdoors.
• Detection challenges: The code is heavily obfuscated and the associated domains change frequently, making it difficult for conventional security tools to flag.
• Impact on AI search: Because the malicious link can appear in AI‑generated results, users who trust those recommendations are at higher risk.

How the Attack Works

1. Search manipulation – Attackers register a domain that mimics a legitimate ChatGPT resource and inject it into Google’s results.

2. ClickFix redirection – The fake domain forwards the request to a ClickFix server that serves a malicious PDF.

3. Payload execution – The PDF contains a concealed macro; when the macro is enabled, it downloads and runs the RAT.

4. Persistence – The installed RAT establishes long‑term access, allowing the attacker to maintain control over the compromised system.

What It Means For Your Business

Small businesses that depend on online discovery and AI tools face a real danger. A compromised search result can give an attacker a foothold inside a customer’s device, leading to data theft, damage to brand reputation, and expensive remediation efforts.

Protect Your Online Presence

• Secure your domain – Implement DNSSEC and continuously monitor for unauthorized redirects.
• Train your team – Teach employees to verify URLs and avoid opening attachments from unknown sources.
• Update endpoint protection – Keep anti‑malware solutions current and disable macros by default wherever possible.
• Leverage VisibilityAI – Our platform monitors citations and flags suspicious activity in your online listings.

Stay Ahead of AI‑Driven Threats

As AI becomes woven into everyday customer interactions, threat actors will increasingly target the pathways that feed those experiences. By staying informed and applying layered security measures, you can protect your brand’s integrity and preserve the trust of your audience.