[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-fake-chatgpt-backup-site-pushes-remote-access-trojan":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},8790,"fake-chatgpt-backup-site-pushes-remote-access-trojan","Fake ChatGPT Backup Site Pushes Remote Access Trojan","A custom GPT named Plus 5.6 posed as an outage notice to funnel victims to a malware site that took over their webcams and files.","A fake ChatGPT model hosted on OpenAI's own domain was actually a doorway to malware.\n\nResearchers at Huntress found a custom GPT called Plus 5.6 that displayed a single message no matter what you typed: a claim that chatgpt.com was experiencing limited availability and a prompt to visit a backup domain. That domain lived on Google Sites, a free website builder, and showed a fake Cloudflare CAPTCHA. Solving it meant copying a command into the Windows Run dialog, a classic ClickFix trick that gets victims to infect themselves. The payload was a remote access trojan Huntress calls @input, capable of taking over a victim's screen, webcam, microphone, and files.\n\nThis works because the custom GPT sits on the real chatgpt.com domain, so the usual advice to check the URL bar is useless. Huntress says the malware is part of a professionally maintained framework, and OpenAI's takedown of the first bot on September 25 did not stop a replacement from appearing two days later. At least 40 incidents trace back to just one of the Google Sites links involved.\n\nClickFix attacks have been spreading for a couple of years now, but routing one through a trusted AI platform's own domain is a reminder that verifying a URL is no longer the same as verifying what is actually running on it.","[\"chatgpt\",\"malware\",\"clickfix\",\"phishing\"]","2026-09-30T16:10:00.000Z","2026-10-01T02:59:27.443Z","2026-10-01T02:59:33.209Z","published",null,[],"security",[26,27,28,29],"chatgpt","malware","clickfix","phishing",[31],{"name":32,"url":33},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fhackers-host-fake-chatgpt-model-on-its-official-website-but-really-its-just-malware",0,{"sections":36},[37,42,46,51,56,61,66,71,76,80,85,90,95,100],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",5236,"2026-09-30T20:13:50.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",799,"2026-09-30T19:29:08.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",426,"2026-09-30T19:46:31.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",298,"2026-09-30T21:00:26.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",196,"2026-09-30T13:00:00.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Science","science",157,"2026-09-30T15:00:56.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Consumer Tech","consumer-tech",148,"2026-09-30T17:53:35.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Dev Tools","dev-tools",92,"2026-09-30T18:17:45.000Z",{"name":77,"slug":78,"count":74,"latest_published_at":79},"Software","software","2026-09-30T17:45:00.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",83,"2026-09-29T21:51:36.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Gaming","gaming",50,"2026-09-30T16:24:30.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"General","general",49,"2026-09-28T16:44:57.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Reviews","reviews",31,"2026-09-28T14:31:34.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]