Custom GPTs Weaponized in ClickFix RAT Campaign, IBM Reports
IBM's cybersecurity division has uncovered a concerning evolution in social engineering attacks, where adversaries have begun incorporating generative AI tools into their offensive toolkit. The campaign centers on the ClickFix technique, a method that tricks users into pasting malicious PowerShell commands into their browser's developer console by disguising the payload as a fix for a non-existent problem.
According to IBM's analysis, attackers are now using custom-built GPTs—AI assistants configured with specific instructions—to generate convincing fake error messages, craft social engineering lures, and even create the malicious scripts used in these attacks. This automation significantly lowers the technical barrier for launching such campaigns and allows for rapid customization at scale.
The RAT (Remote Access Trojan) delivered through these attacks gives attackers persistent remote access to compromised machines, enabling data theft, additional malware deployment, and lateral movement within networks. IBM notes that the use of AI in attack preparation makes the phishing components more polished and harder for users to recognize as malicious.
Security teams are advised to educate users about the risks of pasting commands into browser consoles and to implement detection mechanisms for the command patterns associated with ClickFix attacks.