Fake ChatGPT Plus 5.6 Installs Trojan Horse to Computers

A sponsored link in Google to the users from the call "chatgpt" turned into the entrance gate of a truva horse campaign in the last weeks of September 2026. The cyber security company Huntress announced the users with a fake private GPT called "Plus 5.6" of the attackers in September 28. At least 40 events associated with the campaign were detected. In this article, how the fake ChatGPT Plus 5.6 attack works, what the established truva horse can do and handle ways of protection.

What Is The Fake ChatGPT Plus 5.6 Campaign?

According to the Mark O'Halloran and Jonathan Semon signed report of Huntress Attack started with a sponsored link in Google search results. The link opened to a special GPT called "Plus 5.6" hosted on chatgpt.com, the name of OpenAI's own domain. As the real ChatGPT address appears in the address bar, the page was skating doubt at first glance.

The name was also informed. ChatGPT Plus is the name of the real paid subscription of OpenAI. The "5.6" attachment mimics the company's model numbering. When the fake GPT was opened, a "Service Accessibility Notice", which reported that the service is restricted, was recommended to upgrade or pass to a "yedek" address on Google Sites.

Huntress reviewed at least 40 events linked to this Google Sites page. It was confirmed that two of them start directly through the special GPT. According to the news published in BleepingComputer The first fake GPT removed by OpenAI until September 25. The second copy available after two days is still published, but no longer redirects to the trap page.

How Does Attack Chain Step Work?

Huntress defines infection as an eight-stage chain. Copy and paste a single error command that the user does. Everything remaining happens in the background without a visible warning.

The most part of the installation phase chain. Digital signature of Canon and Stardock is launched valid legitimate applications. These applications run malicious code with their identity by uploading modified DLL files that are left on their sides. The main load is hidden in the case of a audio file and NuGet packages. Anti-virus software blocking a signed Canon app is not expected.

What is ClickFix and Why Is It Effective?

ClickFix is a social engineering technique based on the user’s command copy and paste it into the Play window or PowerShell. As file download alerts are not activated, browser and email filters often do not see this step. Since the person running the command is the user itself, the system accepts the process as a legitimate action.

The technique quickly expanded this year. According to ClickFix analysis published on 23 September of Push Security ClickFix and its derivatives have created 52% of the detections up to the second quarter of the company 2026. The share of ClickFix on Push Security data was released in August 67%. From each five ClickFix load captured, it was reached via search engines such as Google and Bing.

Artificial intelligence-themed traps also stand out in this table. Push Security detected ChatGPT and Claude chats shared with malicious instruction with fake Claude Code and NotebookLM installation guides. ESET’s 2026 first half-threatening report It is also noted that ClickFix is spread beyond fake CAPTCHA alerts to artificial intelligence-themed help pages. Attacks targeting AI assistants are not limited only by this method: BragJack scanner AI Attack He showed that he could handle assistant traffic with a single plugin.

What Can Trojan Horse Do On Computer?

Remote access truva horse (RAT) established according to Huntress's technical analysis, aggressively gives a wide control area on the computer:

• Remote desktop: Display image can be used remotely on computer.

• Camera and microphone: Image and audio recording can be done.

• File manager: Content search between files can be made.

• System discovery: Antivirus collects domain name, network and board software information.

• Additional loads: EXE can run new pests such as DLL, MSI, PowerShell and VBScript.

• Scanner detection: 17 different browser diagnosis and start.

Communication with the command server is installed via DNS-over-HTTPS. Traffic is difficult to distinguish between ordinary encrypted DNS queries in network monitoring tools. It points that browsers can be recognized, registered sessions and passwords can also be targeted. A single laptop connected to the company network is infected, it can provide a starting point for the rest of the aggressive network.

Why Does Special GPTs Stone Safety Risk?

Special GPTs assistants that ChatGPT users can create and share them with connection. All are broadcast under chatgpt.com domain name, which makes them compromise on the reliability of the platform. Even a user who has habited to check the address bar relax when he sees a real OpenAI address. The second stop of the attack is also a well-known service like Google Sites.

Artificial intelligence-themed fraud is now in a organized sector view. Microsoft crashes shortly ago EvilTokens artificial intelligence serviceOver 10,000+ organizations, 12.000 email accounts were discussed.

The life of special GPT is shortened. According to the news published in Virtualization Review OpenAI announced that special GPTs in September 11, will retire at 11 December 2026. The add-ons run on ChatGPT and Codex, consisting of skills and MCP servers. The announcement does not include security grounds. It is not yet known if shared plugins will not take the same trust issue.

How to Protect Fake ChatGPT Trap from?

The warning that Huntress made for the campaign is summarized with the only sentence:

"A legitimate website does not want to copy and paste it into the Play window, Terminal, PowerShell or command prompt." (Huntress)

The measures for individual users are clear. Not from search ads to ChatGPT, the address should be entered directly via writing or official application. Plus subscription is received from account settings or via official app, no need to go to an external address for upgrading. If the command a site has been run, the computer should be separated from the network, the security scan should be done and passwords must be replaced from a clean device.

Technical restrictions are more effective. According to the news published in Help Net Security Huntress proposes the restriction of Win+R Run window and PowerShell access for standard users. It is recommended to look at behavior instead of signature on the detection side. PowerShell processes running the MSI file called GUID from temporary folders and signed applications from unusual locations should be monitored. Timed task pairs with the same name-bearing registry input are also considered skeptical sign. If personal data is leaked from an infected device KVKK obligations in the use of AI companies too.

Frequently Asked Questions

What is Fake ChatGPT Plus 5.6? Fake ChatGPT Plus 5.6 is a malicious special GPT, published on chatgpt.com and redirects users to a malicious page. Google stands out with sponsored connections. The user said that the service is restricted and sent it to a fake verification page, there was a script that created truva horse.

ChatGPT Plus 5.6 is a real version called? No, OpenAI has no product called "Plus 5.6". ChatGPT Plus is the name of a subscription plan, "5.6" attachment is added to mimic model numbers. Subscription upgrades are made from ChatGPT account settings or official applications.

How to understand that ClickFix is exposed to attack? The most clear sign is that a command a website recommends is glued to the Play window or PowerShell. In such a case, the device should be accepted. Programs that are not known from timed tasks and temporary folders are also skeptical sign; the device should be scanned and scanned from the network, passwords should be replaced from another device.

Does this campaign affect Mac users? The chain documented by Huntress is specific to Windows. Attack PowerShell is moving through MSI packages and Windows registry. ClickFix technique must be careful with Mac users as it can adapt to different systems.

When to remove special GPTs? OpenAI will retire special GPTs on 11 December 2026. Plugins consisting of skills and MCP servers to their location. Create new custom GPT in corporate work areas ends on October 26, the last date for approved postpones is 11 February 2027.

The technique behind Fake Plus 5.6 is not new, but the carrier is new: their address of the artificial intelligence platform that users trust most. Special GPTs will close on December, search ads and shared chats stand in place. The next reliable address of the attackers is where to call, the new plugin layout will appear in the first month.