{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 3, "deduplicated_iocs": 23, "direct_entities": 50, "direct_relationships": 117, "invalid_iocs": 0, "iocs": 23, "mentioned": 4, "mitre_associated": 6, "mitre_direct": 1, "targets": 0, "techniques": 1, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 354, "excluded_graph_objects": 526, "graph_complete": true, "graph_objects": 50, "graph_relationships": 117, "mitre_context_complete": true, "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "status_as_of": "2026-10-10T22:52:05+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:23.189Z", "updated_at": "2026-10-05T09:18:08.456Z" }, "description_available": false, "entity_type": "StixFile", "id": "05a8cb78-9db0-4ca5-9cce-aac8f6b86732", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--1dac0525-2c7b-520c-a2b7-43961e591cb5", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:19.897Z", "updated_at": "2026-10-05T09:18:04.083Z" }, "description_available": false, "entity_type": "StixFile", "id": "09d6e6f1-fbec-469a-9380-23eb3df2936f", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--163547f2-05bd-55bc-b7a8-a4efb3de65fd", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:26.188Z", "updated_at": "2026-10-05T09:18:36.764Z" }, "description_available": false, "entity_type": "StixFile", "id": "09d9057d-0587-4841-9bef-59a14ef205ed", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--17904fe8-9c2c-5aff-be22-4d95759bbb33", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.958Z", "created_at": "2026-09-29T19:40:30.773Z", "modified": "2026-10-05T09:19:25.103Z", "updated_at": "2026-10-05T09:19:25.103Z" }, "description_available": false, "entity_type": "Indicator", "id": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--32aa0998-4a28-54ff-9025-cd49844cbaf3", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:26.193Z", "updated_at": "2026-10-05T09:18:33.013Z" }, "description_available": false, "entity_type": "StixFile", "id": "0c678156-bb94-4f15-9b9f-e4fddc2a2597", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--b27063a7-a095-505a-a557-514fa2592e12", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.005Z", "created_at": "2026-09-29T19:40:37.663Z", "modified": "2026-10-05T09:19:30.531Z", "updated_at": "2026-10-05T09:19:30.531Z" }, "description_available": false, "entity_type": "Indicator", "id": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--be3f451a-07c4-5309-8871-8d74e4ace3aa", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:29.205Z", "updated_at": "2026-10-05T09:18:54.884Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "134c3744-0eb9-4fc5-8a63-91efd94bd964", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "ipv4-addr--21daf23f-2edd-58d6-b336-9e734fecbc31", "type": "IPv4Addr" }, { "__typename": "Malware", "aliases": [ "1xxbot", "ArechClient", "win.sectop_rat" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T17:45:16.574Z", "created_at": "2026-01-18T17:45:44.962Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-07T03:24:05.105Z", "updated_at": "2026-10-07T03:24:05.105Z" }, "description_available": true, "entity_type": "Malware", "id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "is_inferred": false, "labels": [ "as216071", "botnet_cc", "c2", "censys", "rat", "sectop", "vdsina" ], "lang": "en", "name": "SectopRAT", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "1f63d842-92bb-4b98-8f1f-a8a295334f6f", "source_name": "alien-vault", "url": "https://www.recordedfuture.com/research/graycharlie-hijacks-law-firm-sites-suspected-supply-chain-attack" }, { "external_id": null, "id": "3a386a0a-a61e-4840-8d91-1d7aafce6263", "source_name": "malpedia", "url": "https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/" }, { "external_id": null, "id": "8efc7aeb-eeb9-4e2a-be40-e41b6d8eda8d", "source_name": "malpedia", "url": "https://cdn-production.blackpointcyber.com/wp-content/uploads/2022/11/01161208/Blackpoint-Cyber-Ratting-out-Arechclient2-Whitepaper.pdf" }, { "external_id": null, "id": "d758714a-78b2-4b60-9b89-6587ee3331aa", "source_name": "malpedia", "url": "https://cyberflorida.org/2022/11/arechclient2/" }, { "external_id": null, "id": "1effdcb9-9c7e-4435-93dd-999b0d199f54", "source_name": "malpedia", "url": "https://dr4k0nia.github.io/posts/Analysing-a-sample-of-ArechClient2/" }, { "external_id": null, "id": "ccdab869-0c8e-4bec-9388-c0cf11a22c1e", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.sectop_rat" }, { "external_id": null, "id": "62710fb1-c4f2-4eec-a662-425e56250b76", "source_name": "malpedia", "url": "https://medium.com/@gi7w0rm/a-long-way-to-sectoprat-eb2f0aad6ec8" }, { "external_id": null, "id": "e41dd644-7fe2-4b80-914e-b724923aa916", "source_name": "malpedia", "url": "https://medium.com/@joshuapenny88/hostinghunter-series-chang-way-technologies-co-limited-a9ba4fce0f65" }, { "external_id": null, "id": "528a245f-1944-46ca-9352-fb2eb04fec90", "source_name": "malpedia", "url": "https://medium.com/@sarviyamalwareanalyst/sectoprat-a-dangerous-remote-access-trojan-spreading-through-google-fake-ads-0c43a15c1cd8" }, { "external_id": null, "id": "63e6fab8-1015-46f6-9907-54a1eba5a3ad", "source_name": "malpedia", "url": "https://medium.com/walmartglobaltech/arechclient-decoding-iocs-and-finding-the-onboard-browser-extension-477f8796568d" }, { "external_id": null, "id": "c2f6967a-3c59-4da9-aaf9-0f68eabe09f2", "source_name": "malpedia", "url": "https://tampabay.tech/2022/11/30/arechclient2/" }, { "external_id": null, "id": "9a4a17bb-c8f9-4314-88c8-14b6e7edc6c3", "source_name": "malpedia", "url": "https://vxhive.blogspot.com/2021/01/deep-dive-into-sectoprat.html" }, { "external_id": null, "id": "c84c0213-93ce-41de-ad4e-cdd0e10c2de0", "source_name": "malpedia", "url": "https://www.cisecurity.org/insights/blog/top-10-malware-march-2022" }, { "external_id": null, "id": "88b6fa52-727f-469e-9766-b968a0f74811", "source_name": "malpedia", "url": "https://www.elastic.co/security-labs/a-wretch-client" }, { "external_id": null, "id": "7812be83-4306-4338-add7-17d21fe13f90", "source_name": "malpedia", "url": "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks" }, { "external_id": null, "id": "f9e70eda-5bf9-495e-9586-83dfc3a5b2a8", "source_name": "malpedia", "url": "https://www.gdatasoftware.com/blog/2019/11/35548-new-sectoprat-remote-access-malware-utilizes-second-desktop-to-control-browsers" }, { "external_id": null, "id": "703b3c5f-fddc-445b-b22b-50c905477cb7", "source_name": "malpedia", "url": "https://www.gdatasoftware.com/blog/2021/02/36633-new-version-adds-encrypted-communication" }, { "external_id": null, "id": "84a20d4a-2f51-477d-93ef-1567290b9e48", "source_name": "malpedia", "url": "https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat" }, { "external_id": null, "id": "cd0674b0-42f2-4200-a169-050a5566f0d7", "source_name": "malpedia", "url": "https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/" }, { "external_id": null, "id": "f9a9cf10-8bb1-4bdd-91bd-68d6148b6cdc", "source_name": "malpedia", "url": "https://www.rewterz.com/rewterz-news/rewterz-threat-alert-widely-abused-msix-app-installer-disabled-by-microsoft-active-iocs" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "malware--66747fba-6971-5200-bd97-d10c9493a2eb", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:21.169Z", "updated_at": "2026-10-05T09:18:04.509Z" }, "description_available": false, "entity_type": "StixFile", "id": "22cee9ca-2bc7-4022-8b00-872ee5d688c9", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--2d0e2db6-c0cf-5eec-83dc-5ed087aefcf9", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.978Z", "created_at": "2026-09-29T19:40:33.581Z", "modified": "2026-10-05T09:19:27.834Z", "updated_at": "2026-10-05T09:19:27.834Z" }, "description_available": false, "entity_type": "Indicator", "id": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--427a7bd2-6212-5558-a1e7-fbcc8ab33413", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.019Z", "created_at": "2026-09-29T19:40:43.449Z", "modified": "2026-10-05T09:19:31.878Z", "updated_at": "2026-10-05T09:19:31.878Z" }, "description_available": false, "entity_type": "Indicator", "id": "29cb4f54-0a74-4e20-966d-680edd27822f", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--a03428b0-8404-5d14-adba-cf744664368b", "type": "Indicator" }, { "__typename": "Malware", "aliases": [ "Atomic macOS Stealer", "osx.amos" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T17:56:41.819Z", "created_at": "2026-01-18T21:06:25.601Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-07T03:13:43.761Z", "updated_at": "2026-10-07T03:13:43.761Z" }, "description_available": true, "entity_type": "Malware", "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "is_inferred": false, "labels": [ "as208137", "botnet_cc", "c2", "fps12", "odyssey", "stealer" ], "lang": "en", "name": "AMOS", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "e89c2187-260b-4f54-9229-4a95be43b81e", "source_name": "malpedia", "url": "https://blog.cyble.com/2023/04/26/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/" }, { "external_id": null, "id": "9eaa3160-38f3-4862-8a51-eb3285d6fe66", "source_name": "malpedia", "url": "https://cyble.com/blog/cyble-chronicles-february-1-latest-findings-recommendations-for-the-cybersecurity-community/" }, { "external_id": null, "id": "823101fb-403b-4c45-91f5-43960507ab81", "source_name": "malpedia", "url": "https://denshiyurei.medium.com/silent-echoes-the-hidden-dialogue-among-malware-entities-spotlight-on-amos-infostealer-6d7cd70e3219" }, { "external_id": null, "id": "7f378525-c3dd-4a2e-935c-132fa227c8b2", "source_name": "malpedia", "url": "https://denwp.com/amos-stealer-fud/" }, { "external_id": null, "id": "4196e239-8ea7-4b25-9e07-97c62a968365", "source_name": "malpedia", "url": "https://hunt.io/blog/macos-odyssey-amos-malware-campaign" }, { "external_id": null, "id": "443ba04c-18fc-461b-a2d6-e91066e05735", "source_name": "malpedia", "url": "https://labs.k7computing.com/index.php/mentalpositives-new-macos-stealer-amos-repackaged-or-a-new-cyber-threat/" }, { "external_id": null, "id": "57fa8e7f-ab5e-4565-8da9-dea5b1d0ee2e", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/osx.amos" }, { "external_id": null, "id": "d2b25bc0-7142-4b4d-b6fe-6482f62085be", "source_name": "malpedia", "url": "https://medium.com/@ireneusz.tarnowski/multi-stage-malware-delivery-campaign-using-seo-poisoning-and-serverless-infrastructure-34e05e551fa3" }, { "external_id": null, "id": "ff7dbb00-4fd9-4bf4-ad53-1d7b6bcec23c", "source_name": "malpedia", "url": "https://redcanary.com/blog/threat-detection/atomic-stealer/" }, { "external_id": null, "id": "7427d1b9-3605-4d35-8591-715c1f33cd84", "source_name": "malpedia", "url": "https://redcanary.com/blog/threat-intelligence/atomic-odyssey-poseidon-stealers/" }, { "external_id": null, "id": "e023298b-34f2-41da-93cf-4f390ca67042", "source_name": "malpedia", "url": "https://russianpanda.com/2024/01/15/Atomic-Stealer-AMOS/" }, { "external_id": null, "id": "98e4e3a6-7fd8-4616-b283-18c885847899", "source_name": "malpedia", "url": "https://securelist.com/crimeware-report-fakesg-akira-amos/111483/" }, { "external_id": null, "id": "f347be62-4dfc-4147-bb88-f8fc79b92e99", "source_name": "malpedia", "url": "https://spycloud.com/blog/reverse-engineering-atomic-macos-stealer/" }, { "external_id": null, "id": "c1032365-e9e0-44ab-b0ee-9d37c31b65ad", "source_name": "malpedia", "url": "https://www.bitdefender.com/blog/labs/when-stealers-converge-new-variant-of-atomic-stealer-in-the-wild/" }, { "external_id": null, "id": "04b1e107-fe39-4950-929e-38db20b48eb6", "source_name": "malpedia", "url": "https://www.huntress.com/blog/amos-stealer-chatgpt-grok-ai-trust" }, { "external_id": null, "id": "65d9a25d-363d-4690-ba24-2b2a15674ee2", "source_name": "malpedia", "url": "https://www.intrinsec.com/wp-content/uploads/2025/10/TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf" }, { "external_id": null, "id": "fa71b90c-f903-48c5-9c54-0013d112f94c", "source_name": "malpedia", "url": "https://www.kroll.com/en/publications/cyber/new-amos-infection-vector-highlights-risks-around-ai-adoption" }, { "external_id": null, "id": "abdb48d8-618e-4268-a52c-dd57482312b9", "source_name": "malpedia", "url": "https://www.malwarebytes.com/blog/news/2025/09/fake-malwarebytes-lastpass-and-others-on-github-serve-malware" }, { "external_id": null, "id": "d6b0e584-2fb4-4e3c-8d8d-7713404f726c", "source_name": "malpedia", "url": "https://www.malwarebytes.com/blog/threat-intelligence/2023/09/atomic-macos-stealer-delivered-via-malvertising" }, { "external_id": null, "id": "9feea419-ff63-4bc3-a7ba-8352a59db067", "source_name": "malpedia", "url": "https://www.malwarebytes.com/blog/threat-intelligence/2024/01/atomic-stealer-rings-in-the-new-year-with-updated-version" }, { "external_id": null, "id": "ec042f45-fcfd-4852-8a9f-d43af6a782e9", "source_name": "malpedia", "url": "https://www.recordedfuture.com/the-travels-of-markopolo-self-proclaimed-meeting-software-vortax-spreads-infostealers" }, { "external_id": null, "id": "b5ab2ff7-cd7b-40d6-b81e-9ece230f389b", "source_name": "malpedia", "url": "https://www.sentinelone.com/blog/atomic-stealer-threat-actor-spawns-second-variant-of-macos-malware-sold-on-telegram/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "malware--31137ce9-53cc-51b1-b312-fece28375ce3", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:25.072Z", "updated_at": "2026-10-05T09:18:24.503Z" }, "description_available": false, "entity_type": "StixFile", "id": "33f0a556-cb64-4fea-b428-943905d8a83f", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--ca021449-b74b-52e3-976c-96cc12fbbdea", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:23.817Z", "updated_at": "2026-10-05T09:18:21.952Z" }, "description_available": false, "entity_type": "StixFile", "id": "37ad0eff-2efe-4493-88c8-364c6f3027e9", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--8a485373-46d9-5b4e-b4db-98d7c5b421c2", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.975Z", "created_at": "2026-09-29T19:40:33.439Z", "modified": "2026-10-05T09:19:28.464Z", "updated_at": "2026-10-05T09:19:28.464Z" }, "description_available": false, "entity_type": "Indicator", "id": "419aa075-2a26-4366-98bd-1d28895faea0", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--3bfc8733-0c38-50e7-a342-f249cc124d70", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.010Z", "created_at": "2026-09-29T19:40:40.623Z", "modified": "2026-10-05T09:19:31.006Z", "updated_at": "2026-10-05T09:19:31.006Z" }, "description_available": false, "entity_type": "Indicator", "id": "437daf69-9c68-4ede-8358-068a0f7441a7", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--bab39d85-6825-567e-9f28-f1a11970b68f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.985Z", "created_at": "2026-09-29T19:40:34.746Z", "modified": "2026-10-05T09:19:29.079Z", "updated_at": "2026-10-05T09:19:29.079Z" }, "description_available": false, "entity_type": "Indicator", "id": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--0717b054-905a-57b6-b856-1542fa4ce05e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.002Z", "created_at": "2026-09-29T19:40:37.638Z", "modified": "2026-10-05T09:19:30.272Z", "updated_at": "2026-10-05T09:19:30.272Z" }, "description_available": false, "entity_type": "Indicator", "id": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--e1e6f607-11bd-5afe-92e5-ecf2b55457cd", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.982Z", "created_at": "2026-09-29T19:40:33.749Z", "modified": "2026-10-05T09:19:28.754Z", "updated_at": "2026-10-05T09:19:28.754Z" }, "description_available": false, "entity_type": "Indicator", "id": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--539c1f2b-47e7-512d-a654-f8c325114ec3", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:22.107Z", "updated_at": "2026-10-05T09:18:05.287Z" }, "description_available": false, "entity_type": "StixFile", "id": "51f928c7-031f-49f1-8c12-d39c6b59c5c6", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--138f2ab3-d68a-5bdf-8650-9172c8348332", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.990Z", "created_at": "2026-09-29T19:40:34.894Z", "modified": "2026-10-05T09:19:29.331Z", "updated_at": "2026-10-05T09:19:29.331Z" }, "description_available": false, "entity_type": "Indicator", "id": "558472d4-6c8d-480c-8bc4-4d5be4461366", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--6f7a1195-712a-505b-88ae-dd7b80bfbf30", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:22.448Z", "updated_at": "2026-10-05T09:18:05.963Z" }, "description_available": false, "entity_type": "StixFile", "id": "62637fd3-c32b-4998-a6da-70e159ba2ed5", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--c756a44f-1f7d-5088-bb25-75ca8934d19f", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:27.349Z", "updated_at": "2026-10-05T09:18:45.637Z" }, "description_available": false, "entity_type": "StixFile", "id": "63b18b02-2cdb-45f3-8aae-166807dbca09", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--afcd315a-abe5-53cf-a904-3b12fcfac2b8", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:27.247Z", "updated_at": "2026-10-05T09:18:44.421Z" }, "description_available": false, "entity_type": "StixFile", "id": "69546ee3-8cb3-43e5-94c9-4a245058ff77", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--4427ae3e-0341-52c8-b66b-7da93d179621", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:22.036Z", "updated_at": "2026-10-05T09:18:04.860Z" }, "description_available": false, "entity_type": "StixFile", "id": "7138f3a9-18f8-49ea-bd26-00ea35887e39", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--05b383e2-b6b2-5dac-af0f-7f3383ec5276", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.000Z", "created_at": "2026-09-29T19:40:37.524Z", "modified": "2026-10-05T09:19:30.021Z", "updated_at": "2026-10-05T09:19:30.021Z" }, "description_available": false, "entity_type": "Indicator", "id": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--438a4346-ea96-5091-8930-04df02107127", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:17.618Z", "updated_at": "2026-10-05T09:18:02.657Z" }, "description_available": false, "entity_type": "StixFile", "id": "86588ec3-ad63-4e70-8458-24d163be8702", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--0b8f2920-f485-5b02-9db2-17333e5b7464", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.022Z", "created_at": "2026-09-29T19:40:43.852Z", "modified": "2026-10-05T09:19:32.042Z", "updated_at": "2026-10-05T09:19:32.042Z" }, "description_available": false, "entity_type": "Indicator", "id": "89672631-bf05-4331-be3c-bca41b144819", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--fa2c1864-7385-5440-ab4c-a31b9f313678", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:28.587Z", "updated_at": "2026-10-05T09:18:52.313Z" }, "description_available": false, "entity_type": "StixFile", "id": "8ca5bd1a-5763-47c9-8b93-26822d4292fa", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--7507793e-106c-55dd-acb6-ffec666f9ddf", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.017Z", "created_at": "2026-09-29T19:40:43.041Z", "modified": "2026-10-05T09:19:31.640Z", "updated_at": "2026-10-05T09:19:31.640Z" }, "description_available": false, "entity_type": "Indicator", "id": "917a8437-2546-4e5d-b547-8baa42eb118e", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--fd38f054-5799-50e2-b132-cd8af7163a23", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.953Z", "created_at": "2026-09-29T19:40:29.248Z", "modified": "2026-10-05T09:19:24.969Z", "updated_at": "2026-10-05T09:19:24.969Z" }, "description_available": false, "entity_type": "Indicator", "id": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--aab2faf1-8ea1-5c4f-820b-137080be7a29", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:19.837Z", "updated_at": "2026-10-05T09:18:03.862Z" }, "description_available": false, "entity_type": "StixFile", "id": "a0f835c9-bbef-4513-b82b-d94d39bd9b59", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--f8b01b87-05a3-5a25-987b-0f362ae96bef", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.966Z", "created_at": "2026-09-29T19:40:32.237Z", "modified": "2026-10-05T09:19:26.800Z", "updated_at": "2026-10-05T09:19:26.800Z" }, "description_available": false, "entity_type": "Indicator", "id": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--40b88e40-55b8-51ee-81f5-a2e9c9c28038", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.971Z", "created_at": "2026-09-29T19:40:32.579Z", "modified": "2026-10-05T09:19:27.258Z", "updated_at": "2026-10-05T09:19:27.258Z" }, "description_available": false, "entity_type": "Indicator", "id": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--780498f0-565f-5720-8f03-c1640de644c2", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.960Z", "created_at": "2026-09-29T19:40:31.187Z", "modified": "2026-10-05T09:19:25.233Z", "updated_at": "2026-10-05T09:19:25.233Z" }, "description_available": false, "entity_type": "Indicator", "id": "b1bfe61e-0534-404a-9f55-67decbc49b74", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--fef457e6-77dd-530b-8f18-84ea1befde24", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:17.941Z", "updated_at": "2026-10-05T09:18:03.263Z" }, "description_available": false, "entity_type": "StixFile", "id": "b288fc28-6061-47a0-b5a4-11a26c4ae3ea", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--f3abed31-6aa4-5eeb-a2ce-83cd38491cdc", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:25.132Z", "updated_at": "2026-10-05T09:18:30.476Z" }, "description_available": false, "entity_type": "StixFile", "id": "b4741383-69d5-47fa-be3f-d9c34165e433", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--26fa0248-0fa6-5727-aa75-53c6c2d4aead", "type": "StixFile" }, { "__typename": "Malware", "aliases": [ "osx.macsync" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-29T10:33:57.399Z", "created_at": "2026-04-20T00:06:21.769Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-07T03:13:51.397Z", "updated_at": "2026-10-07T03:13:51.397Z" }, "description_available": true, "entity_type": "Malware", "id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "is_inferred": false, "labels": [ "botnet_cc", "none" ], "lang": "en", "name": "MacSync", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "0a621f5c-e1a1-4100-8de9-bdd7bc958d9f", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/osx.macsync" }, { "external_id": null, "id": "6e20f7d0-5961-4588-bfaa-c9df2ac070ce", "source_name": "malpedia", "url": "https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "malware--3055d3cf-d404-5a90-a259-35ebce857521", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:26.104Z", "updated_at": "2026-10-05T09:18:34.793Z" }, "description_available": false, "entity_type": "StixFile", "id": "b88d400e-b325-4adc-adbd-cb99c932cd0c", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--ad95a3e5-21e9-5435-ba62-2ba094077831", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:24.910Z", "updated_at": "2026-10-05T09:18:24.502Z" }, "description_available": false, "entity_type": "StixFile", "id": "cfce6bb6-0f73-4823-b7c0-6d057ea52999", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--515e8cd9-6c54-54c7-8063-b53ff48406d3", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:23.347Z", "updated_at": "2026-10-05T09:18:17.523Z" }, "description_available": false, "entity_type": "StixFile", "id": "d2d736cb-7737-4a82-a648-d9a42c099973", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--276eb9c7-eed2-5dd8-8031-3e849315f778", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:27.364Z", "updated_at": "2026-10-05T09:18:45.638Z" }, "description_available": false, "entity_type": "StixFile", "id": "e1c1e75e-1686-462f-8acf-da3bfbdfa058", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--f2c228d8-bb61-57a9-8838-52266ae550f4", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.963Z", "created_at": "2026-09-29T19:40:31.314Z", "modified": "2026-10-05T09:19:26.632Z", "updated_at": "2026-10-05T09:19:26.632Z" }, "description_available": false, "entity_type": "Indicator", "id": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--a8850851-246e-5998-b087-3f538c74c1f8", "type": "Indicator" }, { "__typename": "AttackPattern", "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "entity_type": "Attack-Pattern", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "labels": [], "lang": "en", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "attack-pattern--be8b782f-8ecd-5dd6-817b-9a97173465ca", "type": "AttackPattern" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.014Z", "created_at": "2026-09-29T19:40:40.723Z", "modified": "2026-10-05T09:19:31.212Z", "updated_at": "2026-10-05T09:19:31.212Z" }, "description_available": false, "entity_type": "Indicator", "id": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--03f52250-4531-5aab-9373-ee5592c4316f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.026Z", "created_at": "2026-09-29T19:40:44.889Z", "modified": "2026-10-05T09:19:34.097Z", "updated_at": "2026-10-05T09:19:34.097Z" }, "description_available": false, "entity_type": "Indicator", "id": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--2712d443-bfd6-5434-b369-e9d873843413", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-29T19:40:17.680Z", "updated_at": "2026-10-05T09:18:03.007Z" }, "description_available": false, "entity_type": "StixFile", "id": "f3013048-3cde-4d5c-bb3d-7cd5df8a91b5", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "file--a9059193-4d97-514b-89bb-5fad62a9fe92", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.008Z", "created_at": "2026-09-29T19:40:39.842Z", "modified": "2026-10-05T09:19:30.887Z", "updated_at": "2026-10-05T09:19:30.887Z" }, "description_available": false, "entity_type": "Indicator", "id": "f65fad38-008d-4798-a6d5-0668b6a4a357", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--4ffebb4d-60b7-5822-8767-81ce788b5e14", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.995Z", "created_at": "2026-09-29T19:40:35.005Z", "modified": "2026-10-05T09:19:29.878Z", "updated_at": "2026-10-05T09:19:29.878Z" }, "description_available": false, "entity_type": "Indicator", "id": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--9926f5a2-ea4d-524d-b4e7-70307f971c6f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.969Z", "created_at": "2026-09-29T19:40:32.483Z", "modified": "2026-10-05T09:19:26.799Z", "updated_at": "2026-10-05T09:19:26.799Z" }, "description_available": false, "entity_type": "Indicator", "id": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "is_inferred": false, "labels": [ "amos", "astarionrat", "canon captureontouch", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "dns-over-https", "gomcam", "google sites", "google sites abuse", "lumma stealer", "macsync", "matanbuchus", "persistence mechanisms", "powershell", "powershell obfuscation", "rat deployment", "remote access trojan", "sectoprat", "social engineering", "stardock" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "indicator--bcf652f8-0904-5d99-8cf6-d754eb7223ab", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.042Z", "created_at": "2026-09-29T19:41:51.255Z", "modified": "2026-09-29T19:41:51.457Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:51.457Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "from_id": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "from_name": null, "from_type": "Indicator", "id": "01405570-fa80-4374-a57b-84bb9f6373d7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--55c016f5-3f52-5d26-86be-054a837eadc6", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.967Z", "created_at": "2026-09-29T19:41:25.176Z", "modified": "2026-09-29T19:41:26.819Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:26.819Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "from_id": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "from_name": null, "from_type": "Indicator", "id": "05a3e028-04e4-47f5-bc9c-a123006e58fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--c38564f4-eb3d-57cc-966e-4060bb6c5896", "toId": "09d6e6f1-fbec-469a-9380-23eb3df2936f", "to_id": "09d6e6f1-fbec-469a-9380-23eb3df2936f", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.066Z", "created_at": "2026-09-29T19:43:21.828Z", "modified": "2026-09-29T19:43:21.975Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:21.975Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b1bfe61e-0534-404a-9f55-67decbc49b74", "from_id": "b1bfe61e-0534-404a-9f55-67decbc49b74", "from_name": null, "from_type": "Indicator", "id": "0706aac1-90d3-47aa-875c-0f18604584b2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--b9620f8a-ede4-54e1-8461-0e02635ed002", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.054Z", "created_at": "2026-09-29T19:42:23.003Z", "modified": "2026-09-29T19:42:24.450Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:42:24.450Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b1bfe61e-0534-404a-9f55-67decbc49b74", "from_id": "b1bfe61e-0534-404a-9f55-67decbc49b74", "from_name": null, "from_type": "Indicator", "id": "087d3b09-89fa-4beb-b5ad-05e7b6289fbc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--0c7b23d4-60f5-515a-b9a5-d77f4d1f2b3a", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.440Z", "created_at": "2026-09-29T19:48:11.084Z", "modified": "2026-09-29T19:48:11.386Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:48:11.386Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "from_id": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "from_name": null, "from_type": "Indicator", "id": "0c620bc6-dd26-4b5c-b769-57bdae6fdb08", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--7aff5cf1-311a-59d2-b39d-69a9195da3d6", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.323Z", "created_at": "2026-09-29T19:45:51.156Z", "modified": "2026-09-29T19:45:51.379Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:51.379Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "from_id": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "from_name": null, "from_type": "Indicator", "id": "1106a8e3-6807-42fd-82c6-71dfc71a5d6f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--d41e3300-81d0-56e4-a0f1-2ded0dddabbd", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.425Z", "created_at": "2026-09-29T19:47:52.615Z", "modified": "2026-09-29T19:47:52.947Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:52.947Z" }, "description_available": false, "entity_type": "indicates", "fromId": "29cb4f54-0a74-4e20-966d-680edd27822f", "from_id": "29cb4f54-0a74-4e20-966d-680edd27822f", "from_name": null, "from_type": "Indicator", "id": "112c1507-feda-4a35-b7a0-7c715e524d7d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--3638bab3-7bf3-5526-8507-aec37e7d6fcb", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.378Z", "created_at": "2026-09-29T19:47:03.239Z", "modified": "2026-09-29T19:47:03.937Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:03.937Z" }, "description_available": false, "entity_type": "indicates", "fromId": "437daf69-9c68-4ede-8358-068a0f7441a7", "from_id": "437daf69-9c68-4ede-8358-068a0f7441a7", "from_name": null, "from_type": "Indicator", "id": "135ec954-1fe1-4a71-a60f-f69897960160", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--c95ffa7e-3e45-5513-955c-53cc6d43ea40", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.250Z", "created_at": "2026-09-29T19:44:30.207Z", "modified": "2026-09-29T19:44:30.337Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:30.337Z" }, "description_available": false, "entity_type": "indicates", "fromId": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "from_id": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "from_name": null, "from_type": "Indicator", "id": "14161925-307e-4fb3-81e4-5bf19b0cd0f9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--c37f435e-ccea-5e3a-bcc2-faf9ff14ed6d", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.438Z", "created_at": "2026-09-29T19:48:06.026Z", "modified": "2026-09-29T19:48:06.230Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:48:06.230Z" }, "description_available": false, "entity_type": "indicates", "fromId": "89672631-bf05-4331-be3c-bca41b144819", "from_id": "89672631-bf05-4331-be3c-bca41b144819", "from_name": null, "from_type": "Indicator", "id": "157503b3-30c4-49f4-a330-7aa78ea0838d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--737ad5da-3d7d-523b-9ae1-d7bcfbf753a3", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.249Z", "created_at": "2026-09-29T19:44:29.696Z", "modified": "2026-09-29T19:44:29.862Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:29.862Z" }, "description_available": false, "entity_type": "indicates", "fromId": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "from_id": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "from_name": null, "from_type": "Indicator", "id": "15b0322a-1cfa-4ad5-913b-fa597cdee817", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--2a50f57d-ff8b-5bc6-b844-e55c66992dd7", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.177Z", "created_at": "2026-09-29T19:43:39.941Z", "modified": "2026-09-29T19:43:40.179Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:40.179Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "from_id": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "from_name": null, "from_type": "Indicator", "id": "17008bd2-1177-4f03-b5ea-0e00bb4da010", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--0ce63624-357d-591a-83fe-1322935f00ea", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.052Z", "created_at": "2026-09-29T19:42:06.231Z", "modified": "2026-09-29T19:42:08.320Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:42:08.320Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "from_id": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "from_name": null, "from_type": "Indicator", "id": "171be573-1460-43eb-a7a6-3617cf71e594", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--c46f2b97-50e2-50ca-9c6c-981743409c68", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.173Z", "created_at": "2026-09-29T19:43:35.596Z", "modified": "2026-09-29T19:43:35.786Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:35.786Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "from_id": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "from_name": null, "from_type": "Indicator", "id": "24313ec4-36dc-4f11-b623-13a6208324b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--57c382e8-f0ee-5d44-aba7-7c178e06fd07", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.376Z", "created_at": "2026-09-29T19:46:55.477Z", "modified": "2026-09-29T19:46:56.377Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:56.377Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f65fad38-008d-4798-a6d5-0668b6a4a357", "from_id": "f65fad38-008d-4798-a6d5-0668b6a4a357", "from_name": null, "from_type": "Indicator", "id": "249b43eb-7173-4460-9ccf-0e654bda4c35", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--0137861d-5075-5358-a6de-f16501791fe1", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.416Z", "created_at": "2026-09-29T19:47:41.953Z", "modified": "2026-09-29T19:47:42.782Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:42.782Z" }, "description_available": false, "entity_type": "indicates", "fromId": "29cb4f54-0a74-4e20-966d-680edd27822f", "from_id": "29cb4f54-0a74-4e20-966d-680edd27822f", "from_name": null, "from_type": "Indicator", "id": "272b5402-5b66-49ec-9506-683ec4a32379", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--834183e4-8cc8-5def-b26e-c5b42b5b5fc8", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.040Z", "created_at": "2026-09-29T19:41:48.669Z", "modified": "2026-09-29T19:41:49.156Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:49.156Z" }, "description_available": false, "entity_type": "indicates", "fromId": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "from_id": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "from_name": null, "from_type": "Indicator", "id": "278077c8-462b-45b5-b288-56084c2cc257", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--d7fb452e-09a8-5d65-bd4f-9b81f6ff593f", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.980Z", "created_at": "2026-09-29T19:41:28.384Z", "modified": "2026-09-29T19:41:29.190Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:29.190Z" }, "description_available": false, "entity_type": "based-on", "fromId": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "from_id": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "from_name": null, "from_type": "Indicator", "id": "2841331b-2e26-467b-86bf-e36b6995c30d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--8ef975b7-4587-5b0d-8368-badf709ec778", "toId": "62637fd3-c32b-4998-a6da-70e159ba2ed5", "to_id": "62637fd3-c32b-4998-a6da-70e159ba2ed5", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.378Z", "created_at": "2026-09-29T19:47:00.097Z", "modified": "2026-09-29T19:47:00.434Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:00.434Z" }, "description_available": false, "entity_type": "indicates", "fromId": "437daf69-9c68-4ede-8358-068a0f7441a7", "from_id": "437daf69-9c68-4ede-8358-068a0f7441a7", "from_name": null, "from_type": "Indicator", "id": "29cee4ad-72bc-4a24-ae07-249f0ebb7ea8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--42cc2cc7-2048-5de8-a285-3d66aa3111b6", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.363Z", "created_at": "2026-09-29T19:46:39.212Z", "modified": "2026-09-29T19:46:40.603Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:40.603Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "from_id": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "from_name": null, "from_type": "Indicator", "id": "30e2d168-6b0a-4778-b028-992ed2b090c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--c7a3ac48-2851-5820-8d16-7679a7173d21", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.176Z", "created_at": "2026-09-29T19:43:38.584Z", "modified": "2026-09-29T19:43:38.884Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:38.884Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "from_id": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "from_name": null, "from_type": "Indicator", "id": "32b8b408-d127-4850-8dc5-794732c8b1bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--db4a01b1-48bf-540b-9d96-0e3f4beb2c7f", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.215Z", "created_at": "2026-09-29T19:44:05.943Z", "modified": "2026-09-29T19:44:06.101Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:06.101Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "from_id": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "from_name": null, "from_type": "Indicator", "id": "3393fd58-9975-4fc9-aaf4-34b98de28b2f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--af1e8b31-db20-5462-8d79-05592cc37a44", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.015Z", "created_at": "2026-09-29T19:41:33.905Z", "modified": "2026-09-29T19:41:34.973Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:34.973Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "from_id": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "from_name": null, "from_type": "Indicator", "id": "340c33bb-a68e-4865-b435-59e11776cf6f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--17d98d5a-ea24-54bd-89aa-f1c600bbc052", "toId": "69546ee3-8cb3-43e5-94c9-4a245058ff77", "to_id": "69546ee3-8cb3-43e5-94c9-4a245058ff77", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.055Z", "created_at": "2026-09-29T19:43:06.457Z", "modified": "2026-09-29T19:43:08.764Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:08.764Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b1bfe61e-0534-404a-9f55-67decbc49b74", "from_id": "b1bfe61e-0534-404a-9f55-67decbc49b74", "from_name": null, "from_type": "Indicator", "id": "3494ae96-8a3e-4dc0-b8ad-8dcc0c44d6d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--767f46c2-e726-5c1a-a2bb-095999241927", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.280Z", "created_at": "2026-09-29T19:44:59.637Z", "modified": "2026-09-29T19:44:59.813Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:59.813Z" }, "description_available": false, "entity_type": "indicates", "fromId": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "from_id": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "from_name": null, "from_type": "Indicator", "id": "3765cc68-ff1f-4a7e-b04d-54954cdc97a1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--f4491119-2806-5fc4-9dd9-b33bed21e91c", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.021Z", "created_at": "2026-09-29T19:41:35.049Z", "modified": "2026-09-29T19:41:35.802Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:35.802Z" }, "description_available": false, "entity_type": "based-on", "fromId": "29cb4f54-0a74-4e20-966d-680edd27822f", "from_id": "29cb4f54-0a74-4e20-966d-680edd27822f", "from_name": null, "from_type": "Indicator", "id": "3c7d1e17-2332-4b9c-90de-b51a619d68ca", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--f13126b1-75d5-5ad8-b75b-a8e029ca0c9d", "toId": "e1c1e75e-1686-462f-8acf-da3bfbdfa058", "to_id": "e1c1e75e-1686-462f-8acf-da3bfbdfa058", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.027Z", "created_at": "2026-09-29T19:41:36.507Z", "modified": "2026-09-29T19:41:37.671Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:37.671Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "from_id": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "from_name": null, "from_type": "Indicator", "id": "448d90d2-3fde-4eca-b19a-42f20dc5159b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--8703ad78-1728-5f26-829e-11e032f9a885", "toId": "134c3744-0eb9-4fc5-8a63-91efd94bd964", "to_id": "134c3744-0eb9-4fc5-8a63-91efd94bd964", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.322Z", "created_at": "2026-09-29T19:45:51.345Z", "modified": "2026-09-29T19:45:51.601Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:51.601Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "from_id": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "from_name": null, "from_type": "Indicator", "id": "466cb4b9-21b3-4a8a-ac2b-6a2720cdd8c7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--e7905574-4d1b-541c-95ba-3242a320b315", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.956Z", "created_at": "2026-09-29T19:41:20.662Z", "modified": "2026-09-29T19:41:23.713Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:23.713Z" }, "description_available": false, "entity_type": "based-on", "fromId": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "from_id": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "from_name": null, "from_type": "Indicator", "id": "4a5b02ab-6199-46ba-ac2b-3169c0082efe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--cb1c6ba6-bce3-58c6-9018-a8d1f4e9dbed", "toId": "f3013048-3cde-4d5c-bb3d-7cd5df8a91b5", "to_id": "f3013048-3cde-4d5c-bb3d-7cd5df8a91b5", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.440Z", "created_at": "2026-09-29T19:48:08.352Z", "modified": "2026-09-29T19:48:08.556Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:48:08.556Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "from_id": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "from_name": null, "from_type": "Indicator", "id": "51e08c64-80c2-4780-8334-8d8cbbd20351", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--1c8c51d9-ed85-5a81-b088-3e4f25fd3883", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.993Z", "created_at": "2026-09-29T19:41:29.865Z", "modified": "2026-09-29T19:41:30.353Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:30.353Z" }, "description_available": false, "entity_type": "based-on", "fromId": "558472d4-6c8d-480c-8bc4-4d5be4461366", "from_id": "558472d4-6c8d-480c-8bc4-4d5be4461366", "from_name": null, "from_type": "Indicator", "id": "52c1822f-ed14-4b1e-9d77-7d34f4936a19", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--b7073992-29d2-53ef-9fa2-e5418cbd16e3", "toId": "37ad0eff-2efe-4493-88c8-364c6f3027e9", "to_id": "37ad0eff-2efe-4493-88c8-364c6f3027e9", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.962Z", "created_at": "2026-09-29T19:41:21.237Z", "modified": "2026-09-29T19:41:23.715Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:23.715Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b1bfe61e-0534-404a-9f55-67decbc49b74", "from_id": "b1bfe61e-0534-404a-9f55-67decbc49b74", "from_name": null, "from_type": "Indicator", "id": "56db2077-2aa8-4506-b900-96b4a58286da", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--04b48ece-7c14-5a09-bb00-c9a3abfcb7e4", "toId": "b288fc28-6061-47a0-b5a4-11a26c4ae3ea", "to_id": "b288fc28-6061-47a0-b5a4-11a26c4ae3ea", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.401Z", "created_at": "2026-09-29T19:47:22.147Z", "modified": "2026-09-29T19:47:22.286Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:22.286Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "from_id": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "from_name": null, "from_type": "Indicator", "id": "5a339ede-350b-4382-ba4d-6c41a643fe35", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--d795fd3d-ae74-5a07-a591-c374241337e2", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.450Z", "created_at": "2026-09-29T19:48:21.271Z", "modified": "2026-09-29T19:48:23.059Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:48:23.059Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "from_id": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "from_name": null, "from_type": "Indicator", "id": "5e44adae-c35a-440a-84d3-6bd7dc77615d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--f62b08ac-c347-5c67-9ca1-c95298d40d41", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.236Z", "created_at": "2026-09-29T19:44:15.706Z", "modified": "2026-09-29T19:44:15.935Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:15.935Z" }, "description_available": false, "entity_type": "indicates", "fromId": "419aa075-2a26-4366-98bd-1d28895faea0", "from_id": "419aa075-2a26-4366-98bd-1d28895faea0", "from_name": null, "from_type": "Indicator", "id": "5ea77deb-6faf-464f-8bd0-3fe4a357d620", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--e05e856b-0d51-51d5-9a58-41ce299fe57b", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.276Z", "created_at": "2026-09-29T19:44:56.583Z", "modified": "2026-09-29T19:44:57.560Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:57.560Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "from_id": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "from_name": null, "from_type": "Indicator", "id": "5f284871-d861-4b22-b94b-82aa97d68e4d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--6138ef33-3cdd-5086-b8ed-8ac848ea2e41", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.336Z", "created_at": "2026-09-29T19:46:03.585Z", "modified": "2026-09-29T19:46:04.827Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:04.827Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "from_id": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "from_name": null, "from_type": "Indicator", "id": "6156b419-01b0-4020-8216-6af65c2bfb20", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--2e63fbdd-eef7-50dd-930b-2eab56928f63", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.197Z", "created_at": "2026-09-29T19:43:51.650Z", "modified": "2026-09-29T19:43:51.873Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:51.873Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "from_id": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "from_name": null, "from_type": "Indicator", "id": "6184cf8e-9d9a-488a-82f8-f5ac5c934b9f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--0f14a141-8056-5fbc-8a9d-c5c023291d9d", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.024Z", "created_at": "2026-09-29T19:41:35.887Z", "modified": "2026-09-29T19:41:36.363Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:36.363Z" }, "description_available": false, "entity_type": "based-on", "fromId": "89672631-bf05-4331-be3c-bca41b144819", "from_id": "89672631-bf05-4331-be3c-bca41b144819", "from_name": null, "from_type": "Indicator", "id": "62587d30-e0c8-499d-8846-825e11ecef9f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--57794da0-edeb-5210-935d-5de6a882c6e0", "toId": "8ca5bd1a-5763-47c9-8b93-26822d4292fa", "to_id": "8ca5bd1a-5763-47c9-8b93-26822d4292fa", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.263Z", "created_at": "2026-09-29T19:44:45.732Z", "modified": "2026-09-29T19:44:45.991Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:45.991Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "from_id": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "from_name": null, "from_type": "Indicator", "id": "68bcd1cc-cb04-4493-8958-718466e4913a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--93e74e71-245f-5750-a28f-3d93bca5b2b7", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.194Z", "created_at": "2026-09-29T19:43:50.358Z", "modified": "2026-09-29T19:43:50.505Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:50.505Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "from_id": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "from_name": null, "from_type": "Indicator", "id": "6b26ae77-21d6-4903-9eea-0939e9835b19", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--43dd5433-e033-59ac-a64d-bdb77101dcef", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.404Z", "created_at": "2026-09-29T19:47:27.246Z", "modified": "2026-09-29T19:47:27.480Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:27.480Z" }, "description_available": false, "entity_type": "indicates", "fromId": "917a8437-2546-4e5d-b547-8baa42eb118e", "from_id": "917a8437-2546-4e5d-b547-8baa42eb118e", "from_name": null, "from_type": "Indicator", "id": "6cdc4d68-456a-4f7e-b2b5-6c7fd5282e21", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--f34ab719-5380-5d32-a598-dd15f924ee17", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.366Z", "created_at": "2026-09-29T19:46:47.795Z", "modified": "2026-09-29T19:46:48.022Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:48.022Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f65fad38-008d-4798-a6d5-0668b6a4a357", "from_id": "f65fad38-008d-4798-a6d5-0668b6a4a357", "from_name": null, "from_type": "Indicator", "id": "6ee534e3-bfdf-4fde-8d92-e4753042846b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--4fe4eb1f-6faf-5e0f-ae69-4d21738ce09c", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.067Z", "created_at": "2026-09-29T19:43:24.183Z", "modified": "2026-09-29T19:43:24.341Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:24.341Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "from_id": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "from_name": null, "from_type": "Indicator", "id": "6fef6279-5c25-4c58-beb2-50b3033c1a65", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--894344c0-b83c-55d0-a798-332ebbe491e8", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.403Z", "created_at": "2026-09-29T19:47:23.627Z", "modified": "2026-09-29T19:47:23.847Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:23.847Z" }, "description_available": false, "entity_type": "indicates", "fromId": "917a8437-2546-4e5d-b547-8baa42eb118e", "from_id": "917a8437-2546-4e5d-b547-8baa42eb118e", "from_name": null, "from_type": "Indicator", "id": "707f0dc9-d834-4bcc-9584-87fb3e9609d7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--6d7e01c3-5f5c-59d4-8b7c-ada083cd9048", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.353Z", "created_at": "2026-09-29T19:46:23.815Z", "modified": "2026-09-29T19:46:24.121Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:24.121Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "from_id": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "from_name": null, "from_type": "Indicator", "id": "75560257-5a58-449f-afe0-bbabe82c2bfa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--edd60c6d-632d-504c-8111-f766d61ba11d", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.338Z", "created_at": "2026-09-29T19:46:06.391Z", "modified": "2026-09-29T19:46:07.599Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:07.599Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "from_id": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "from_name": null, "from_type": "Indicator", "id": "76eefe41-96f8-4b34-a1fb-cef224afc8d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--7b9358c9-6b09-5f97-aa78-864fc4778607", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.415Z", "created_at": "2026-09-29T19:47:36.568Z", "modified": "2026-09-29T19:47:36.801Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:36.801Z" }, "description_available": false, "entity_type": "indicates", "fromId": "29cb4f54-0a74-4e20-966d-680edd27822f", "from_id": "29cb4f54-0a74-4e20-966d-680edd27822f", "from_name": null, "from_type": "Indicator", "id": "779592fb-5d38-41fa-932f-1014e0c3c52d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--274216f2-1059-5bb4-9158-b049c377490b", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.263Z", "created_at": "2026-09-29T19:44:46.196Z", "modified": "2026-09-29T19:44:46.383Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:46.383Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "from_id": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "from_name": null, "from_type": "Indicator", "id": "793c5cd7-6b2d-4fd7-b602-422cc4ccabec", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--d0d7095c-499b-5b9e-baa6-7e63639b1ee6", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.959Z", "created_at": "2026-09-29T19:41:20.923Z", "modified": "2026-09-29T19:41:23.714Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:23.714Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "from_id": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "from_name": null, "from_type": "Indicator", "id": "794a1076-d026-4bf7-97e8-572e0ba73219", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--b9c922f9-6fa0-596a-b4fa-e0d64d4f3b9e", "toId": "86588ec3-ad63-4e70-8458-24d163be8702", "to_id": "86588ec3-ad63-4e70-8458-24d163be8702", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.389Z", "created_at": "2026-09-29T19:47:12.416Z", "modified": "2026-09-29T19:47:12.723Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:12.723Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "from_id": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "from_name": null, "from_type": "Indicator", "id": "799b8337-8e29-4fe2-8d2e-eecb1e344909", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--fb374a96-1266-525f-8a84-769552d9b960", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.030Z", "created_at": "2026-09-29T19:41:41.815Z", "modified": "2026-09-29T19:41:41.929Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:41.929Z" }, "description_available": false, "entity_type": "indicates", "fromId": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "from_id": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "from_name": null, "from_type": "Indicator", "id": "7cac975c-cd71-4d91-b6a1-c546182b28d1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--f180b99a-be3a-5c94-a486-5c7608ff9aa0", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.068Z", "created_at": "2026-09-29T19:43:24.678Z", "modified": "2026-09-29T19:43:24.927Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:24.927Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "from_id": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "from_name": null, "from_type": "Indicator", "id": "81f1efaa-6df7-40f6-9378-40e8625cf079", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--b59e950c-58c1-5ed3-a80b-696ee6ae24e8", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.352Z", "created_at": "2026-09-29T19:46:23.274Z", "modified": "2026-09-29T19:46:23.502Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:23.502Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "from_id": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "from_name": null, "from_type": "Indicator", "id": "82407098-482a-4c16-a91c-c56f9ebf6212", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--938191b7-23f2-5283-9375-8b8c275c17fe", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.413Z", "created_at": "2026-09-29T19:47:36.628Z", "modified": "2026-09-29T19:47:36.981Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:36.981Z" }, "description_available": false, "entity_type": "indicates", "fromId": "917a8437-2546-4e5d-b547-8baa42eb118e", "from_id": "917a8437-2546-4e5d-b547-8baa42eb118e", "from_name": null, "from_type": "Indicator", "id": "846b38a0-ce68-4100-85a3-286c3424f6dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--dee6a67b-0880-54ca-b604-1e113deeac75", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.229Z", "created_at": "2026-09-29T19:44:14.229Z", "modified": "2026-09-29T19:44:14.618Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:14.618Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "from_id": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "from_name": null, "from_type": "Indicator", "id": "8690be99-db4f-4613-99d7-ed35f5b1ce3f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--1e56dfa4-ff6b-5387-a570-823a43e4541c", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.235Z", "created_at": "2026-09-29T19:44:15.057Z", "modified": "2026-09-29T19:44:15.284Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:15.284Z" }, "description_available": false, "entity_type": "indicates", "fromId": "419aa075-2a26-4366-98bd-1d28895faea0", "from_id": "419aa075-2a26-4366-98bd-1d28895faea0", "from_name": null, "from_type": "Indicator", "id": "86e97c28-a03c-4417-8397-0ebfe75360f0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--dda7a811-9693-5df9-ab64-e82b3fd9506d", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.970Z", "created_at": "2026-09-29T19:41:25.170Z", "modified": "2026-09-29T19:41:26.651Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:26.651Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "from_id": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "from_name": null, "from_type": "Indicator", "id": "8787b8db-aeb3-4ef8-b023-74bc39736aa9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--6d02ebff-3e83-5fba-9239-8864578e297d", "toId": "22cee9ca-2bc7-4022-8b00-872ee5d688c9", "to_id": "22cee9ca-2bc7-4022-8b00-872ee5d688c9", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.018Z", "created_at": "2026-09-29T19:41:34.121Z", "modified": "2026-09-29T19:41:35.801Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:35.801Z" }, "description_available": false, "entity_type": "based-on", "fromId": "917a8437-2546-4e5d-b547-8baa42eb118e", "from_id": "917a8437-2546-4e5d-b547-8baa42eb118e", "from_name": null, "from_type": "Indicator", "id": "8d676521-4173-4757-b10c-fb3eee88d2d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--ee75d1ee-aa98-5849-924e-eef287a0135f", "toId": "63b18b02-2cdb-45f3-8aae-166807dbca09", "to_id": "63b18b02-2cdb-45f3-8aae-166807dbca09", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.427Z", "created_at": "2026-09-29T19:47:56.409Z", "modified": "2026-09-29T19:47:56.699Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:56.699Z" }, "description_available": false, "entity_type": "indicates", "fromId": "89672631-bf05-4331-be3c-bca41b144819", "from_id": "89672631-bf05-4331-be3c-bca41b144819", "from_name": null, "from_type": "Indicator", "id": "8ef8885a-6ed1-48ed-88c7-9b8208aad1d6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--8b402fb0-1817-5500-bf11-c77849827bf2", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.199Z", "created_at": "2026-09-29T19:43:52.295Z", "modified": "2026-09-29T19:43:52.473Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:52.473Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "from_id": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "from_name": null, "from_type": "Indicator", "id": "8f743fe4-bcb4-4472-8c00-02e49cec5678", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--2dd622e7-bcba-5701-95cb-da466b09dfc3", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.350Z", "created_at": "2026-09-29T19:46:18.020Z", "modified": "2026-09-29T19:46:18.176Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:18.176Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "from_id": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "from_name": null, "from_type": "Indicator", "id": "9069b65e-8189-4604-a084-ae82ff9ae5c5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--cf22f4c6-4702-59db-910f-5dcd09f392ce", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.310Z", "created_at": "2026-09-29T19:45:32.549Z", "modified": "2026-09-29T19:45:32.749Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:32.749Z" }, "description_available": false, "entity_type": "indicates", "fromId": "558472d4-6c8d-480c-8bc4-4d5be4461366", "from_id": "558472d4-6c8d-480c-8bc4-4d5be4461366", "from_name": null, "from_type": "Indicator", "id": "938557b0-e68a-4f4b-b0b2-111cedb385ea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--6ef5ba50-a934-5f4a-a059-fa70f529a4c6", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.004Z", "created_at": "2026-09-29T19:41:30.955Z", "modified": "2026-09-29T19:41:32.768Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:32.768Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "from_id": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "from_name": null, "from_type": "Indicator", "id": "9497082d-37ea-4b15-adba-bf0bf79c50e7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--e2372740-5fa5-58d3-ae01-db817d590def", "toId": "b4741383-69d5-47fa-be3f-d9c34165e433", "to_id": "b4741383-69d5-47fa-be3f-d9c34165e433", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.377Z", "created_at": "2026-09-29T19:46:58.725Z", "modified": "2026-09-29T19:46:58.900Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:58.900Z" }, "description_available": false, "entity_type": "indicates", "fromId": "437daf69-9c68-4ede-8358-068a0f7441a7", "from_id": "437daf69-9c68-4ede-8358-068a0f7441a7", "from_name": null, "from_type": "Indicator", "id": "9617b687-b9d6-46e2-ab0c-ce8c60a9d0ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--6b72c118-e91e-573d-b20a-2a11d512488a", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.042Z", "created_at": "2026-09-29T19:41:52.292Z", "modified": "2026-09-29T19:41:52.515Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:52.515Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "from_id": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "from_name": null, "from_type": "Indicator", "id": "962b99c9-71be-4396-b321-1110eaeea559", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--1a5ff833-140d-5215-932d-c2c428a39ff1", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.324Z", "created_at": "2026-09-29T19:45:56.853Z", "modified": "2026-09-29T19:45:57.030Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:57.030Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "from_id": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "from_name": null, "from_type": "Indicator", "id": "9693a918-b582-4ef6-966d-fe961ebcfcb0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--a5b2602c-c865-5717-9d4d-66e3ce46323f", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.366Z", "created_at": "2026-09-29T19:46:43.076Z", "modified": "2026-09-29T19:46:43.849Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:43.849Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f65fad38-008d-4798-a6d5-0668b6a4a357", "from_id": "f65fad38-008d-4798-a6d5-0668b6a4a357", "from_name": null, "from_type": "Indicator", "id": "96fb6849-ac9f-4246-aca1-c9071394a8ec", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--3902db1b-73fc-5008-b22a-718bab0e0617", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.300Z", "created_at": "2026-09-29T19:45:18.615Z", "modified": "2026-09-29T19:45:18.889Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:18.889Z" }, "description_available": false, "entity_type": "indicates", "fromId": "558472d4-6c8d-480c-8bc4-4d5be4461366", "from_id": "558472d4-6c8d-480c-8bc4-4d5be4461366", "from_name": null, "from_type": "Indicator", "id": "971c2c8e-d645-4a05-9444-8aa01f9a81fd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--50e98189-4c0a-515d-bd29-cc8044ef60de", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.009Z", "created_at": "2026-09-29T19:41:33.398Z", "modified": "2026-09-29T19:41:33.801Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:33.801Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f65fad38-008d-4798-a6d5-0668b6a4a357", "from_id": "f65fad38-008d-4798-a6d5-0668b6a4a357", "from_name": null, "from_type": "Indicator", "id": "980830d6-8832-45d6-bf44-ec29fb638d53", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--cd4badd3-4700-5651-9aa5-fba34428dd02", "toId": "0c678156-bb94-4f15-9b9f-e4fddc2a2597", "to_id": "0c678156-bb94-4f15-9b9f-e4fddc2a2597", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.415Z", "created_at": "2026-09-29T19:47:37.061Z", "modified": "2026-09-29T19:47:37.299Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:37.299Z" }, "description_available": false, "entity_type": "indicates", "fromId": "29cb4f54-0a74-4e20-966d-680edd27822f", "from_id": "29cb4f54-0a74-4e20-966d-680edd27822f", "from_name": null, "from_type": "Indicator", "id": "9a8a9f11-1673-42b9-a562-303bc63b1bb1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--1dfead8c-a191-5ffe-a412-17192ad5c71d", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.249Z", "created_at": "2026-09-29T19:44:33.184Z", "modified": "2026-09-29T19:44:33.446Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:33.446Z" }, "description_available": false, "entity_type": "indicates", "fromId": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "from_id": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "from_name": null, "from_type": "Indicator", "id": "9aebfaae-f1c2-418b-8848-1129cb199c00", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--14b8b9c5-65a4-526c-bf2d-94b9f3ce0ba8", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.247Z", "created_at": "2026-09-29T19:44:27.818Z", "modified": "2026-09-29T19:44:28.033Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:28.033Z" }, "description_available": false, "entity_type": "indicates", "fromId": "419aa075-2a26-4366-98bd-1d28895faea0", "from_id": "419aa075-2a26-4366-98bd-1d28895faea0", "from_name": null, "from_type": "Indicator", "id": "9c95f37a-94c6-489e-9d39-5a152f4fe290", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--f8ae67f2-3911-5377-8376-bfdde7ea2a19", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.339Z", "created_at": "2026-09-29T19:46:07.994Z", "modified": "2026-09-29T19:46:08.512Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:08.512Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "from_id": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "from_name": null, "from_type": "Indicator", "id": "9dd9c37a-3fdf-4972-9300-c1d78136759e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--26ea52e1-c2c6-57e3-9b09-9501fdb87af4", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.365Z", "created_at": "2026-09-29T19:46:42.287Z", "modified": "2026-09-29T19:46:42.480Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:42.480Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f65fad38-008d-4798-a6d5-0668b6a4a357", "from_id": "f65fad38-008d-4798-a6d5-0668b6a4a357", "from_name": null, "from_type": "Indicator", "id": "9de48dd4-5da4-46c3-8868-f1f7af105e78", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--244798c0-9cf7-5a14-a8ad-4e41148bc74e", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.007Z", "created_at": "2026-09-29T19:41:33.140Z", "modified": "2026-09-29T19:41:33.416Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:33.416Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "from_id": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "from_name": null, "from_type": "Indicator", "id": "a6d8e457-bec5-4a97-823a-6ce9d5def092", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--1fd1f334-3357-5812-82d1-fbbf19e0ee63", "toId": "b88d400e-b325-4adc-adbd-cb99c932cd0c", "to_id": "b88d400e-b325-4adc-adbd-cb99c932cd0c", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.260Z", "created_at": "2026-09-29T19:44:45.054Z", "modified": "2026-09-29T19:44:45.668Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:45.668Z" }, "description_available": false, "entity_type": "indicates", "fromId": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "from_id": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "from_name": null, "from_type": "Indicator", "id": "aa2139aa-9650-455a-a2fd-6a591caaf745", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--dd17691c-4214-5d91-a42a-3f01f815746e", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:30:15.771Z", "created_at": "2026-04-21T13:42:18.491Z", "modified": "2026-04-21T13:42:18.927Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-21T13:42:18.927Z" }, "description_available": false, "entity_type": "uses", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--25ba721f-0c28-5c46-984c-a72f9063c358", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.973Z", "created_at": "2026-09-29T19:41:27.471Z", "modified": "2026-09-29T19:41:28.932Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:28.932Z" }, "description_available": false, "entity_type": "based-on", "fromId": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "from_id": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "from_name": null, "from_type": "Indicator", "id": "af64bade-a201-4461-9a41-2fa863c14fce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--ae538e3b-2803-5fef-a342-ad70b2b39be3", "toId": "7138f3a9-18f8-49ea-bd26-00ea35887e39", "to_id": "7138f3a9-18f8-49ea-bd26-00ea35887e39", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.403Z", "created_at": "2026-09-29T19:47:24.243Z", "modified": "2026-09-29T19:47:24.464Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:24.464Z" }, "description_available": false, "entity_type": "indicates", "fromId": "917a8437-2546-4e5d-b547-8baa42eb118e", "from_id": "917a8437-2546-4e5d-b547-8baa42eb118e", "from_name": null, "from_type": "Indicator", "id": "b17e3a5d-e852-41fc-8178-2e88973bcf4c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--4f387780-0806-56eb-b335-fe27bdde7c48", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.984Z", "created_at": "2026-09-29T19:41:29.656Z", "modified": "2026-09-29T19:41:30.070Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:30.070Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "from_id": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "from_name": null, "from_type": "Indicator", "id": "b278e577-eb67-4a57-bed1-fa0a6e4bc62d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--3dae0a36-5703-54bb-b6a8-1936b3009a4e", "toId": "05a8cb78-9db0-4ca5-9cce-aac8f6b86732", "to_id": "05a8cb78-9db0-4ca5-9cce-aac8f6b86732", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.212Z", "created_at": "2026-09-29T19:44:01.977Z", "modified": "2026-09-29T19:44:02.353Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:02.353Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "from_id": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "from_name": null, "from_type": "Indicator", "id": "b554efc6-2e2c-45c3-9dca-89810f14f447", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--16944354-7cbc-545b-bfa0-fdcf410f72c5", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.313Z", "created_at": "2026-09-29T19:45:36.654Z", "modified": "2026-09-29T19:45:37.026Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:37.026Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "from_id": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "from_name": null, "from_type": "Indicator", "id": "b8f6fce7-29e6-4d92-9793-69765b158222", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--26872712-c975-554a-a54b-bb0d6376992d", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.388Z", "created_at": "2026-09-29T19:47:10.536Z", "modified": "2026-09-29T19:47:10.828Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:10.828Z" }, "description_available": false, "entity_type": "indicates", "fromId": "437daf69-9c68-4ede-8358-068a0f7441a7", "from_id": "437daf69-9c68-4ede-8358-068a0f7441a7", "from_name": null, "from_type": "Indicator", "id": "b9804c4d-e4ca-49d9-8a6b-4c20a77a696a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--dcf62612-5f31-558a-a9b6-ceacab7872cd", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.324Z", "created_at": "2026-09-29T19:45:51.785Z", "modified": "2026-09-29T19:45:51.975Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:51.975Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "from_id": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "from_name": null, "from_type": "Indicator", "id": "bf821eb8-71bc-4fe4-ba80-25513bcf99be", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--f55bc83c-ef6d-5797-a0e0-0fe0e7a92270", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.280Z", "created_at": "2026-09-29T19:45:04.193Z", "modified": "2026-09-29T19:45:04.387Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:04.387Z" }, "description_available": false, "entity_type": "indicates", "fromId": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "from_id": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "from_name": null, "from_type": "Indicator", "id": "bfb1be52-429f-4943-a0d4-5d461455f9c4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--d2b0801a-51c9-556e-b1d8-6bf329a0bbf2", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.998Z", "created_at": "2026-09-29T19:41:30.670Z", "modified": "2026-09-29T19:41:32.016Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:32.016Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "from_id": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "from_name": null, "from_type": "Indicator", "id": "c2c787db-0fc1-46e2-be73-c55b03d3f22b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--67628e40-e7f7-5dfb-aff9-4e22d842b56c", "toId": "cfce6bb6-0f73-4823-b7c0-6d057ea52999", "to_id": "cfce6bb6-0f73-4823-b7c0-6d057ea52999", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.198Z", "created_at": "2026-09-29T19:43:55.293Z", "modified": "2026-09-29T19:43:55.431Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:55.431Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "from_id": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "from_name": null, "from_type": "Indicator", "id": "c851d546-8ad3-46d4-bdb8-9eed1b746f1d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--b5206f9f-19a7-54d8-9be7-294125a85370", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.001Z", "created_at": "2026-09-29T19:41:30.950Z", "modified": "2026-09-29T19:41:32.767Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:32.767Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "from_id": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "from_name": null, "from_type": "Indicator", "id": "ca7ebe60-4690-4857-8460-4738a07997c7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--0594633a-951b-5135-80fa-c53f194bc5ae", "toId": "33f0a556-cb64-4fea-b428-943905d8a83f", "to_id": "33f0a556-cb64-4fea-b428-943905d8a83f", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.178Z", "created_at": "2026-09-29T19:43:39.321Z", "modified": "2026-09-29T19:43:39.668Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:39.668Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "from_id": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "from_name": null, "from_type": "Indicator", "id": "cad5bb65-b72b-4fff-87aa-a811fb71bbf3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--bb807e16-9f8a-5d92-8334-e031281ba090", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.234Z", "created_at": "2026-09-29T19:44:19.652Z", "modified": "2026-09-29T19:44:19.902Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:19.902Z" }, "description_available": false, "entity_type": "indicates", "fromId": "419aa075-2a26-4366-98bd-1d28895faea0", "from_id": "419aa075-2a26-4366-98bd-1d28895faea0", "from_name": null, "from_type": "Indicator", "id": "cba6d60f-8a09-4f96-9f3a-1a2bd5c3f702", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--b6974116-d82d-5e89-957e-b7e57132de66", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.029Z", "created_at": "2026-09-29T19:41:49.992Z", "modified": "2026-09-29T19:41:50.330Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:50.330Z" }, "description_available": false, "entity_type": "indicates", "fromId": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "from_id": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "from_name": null, "from_type": "Indicator", "id": "cd8bb598-3a84-4df3-ab35-88d5713e411c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--9b55af8c-02dc-55a0-883d-692a34c4435a", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.428Z", "created_at": "2026-09-29T19:47:53.276Z", "modified": "2026-09-29T19:47:55.228Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:55.228Z" }, "description_available": false, "entity_type": "indicates", "fromId": "89672631-bf05-4331-be3c-bca41b144819", "from_id": "89672631-bf05-4331-be3c-bca41b144819", "from_name": null, "from_type": "Indicator", "id": "cd8c9d4a-6bb2-44d2-a46f-3c92c3ca90e8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--c440a896-9588-574f-8595-8cbe897db99b", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.262Z", "created_at": "2026-09-29T19:44:44.757Z", "modified": "2026-09-29T19:44:45.070Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:45.070Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "from_id": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "from_name": null, "from_type": "Indicator", "id": "cfdbcd9a-ceae-4547-bdb7-bed8ade35d7f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--5fa8a540-b241-583d-9359-77da56d33e9b", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.068Z", "created_at": "2026-09-29T19:43:27.360Z", "modified": "2026-09-29T19:43:27.575Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:43:27.575Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "from_id": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "from_name": null, "from_type": "Indicator", "id": "d00f4799-f95f-4097-8a01-96fdd1751084", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--48c37a08-57f3-5a89-aca2-8163a8c0981c", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.279Z", "created_at": "2026-09-29T19:44:58.765Z", "modified": "2026-09-29T19:44:59.253Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:59.253Z" }, "description_available": false, "entity_type": "indicates", "fromId": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "from_id": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "from_name": null, "from_type": "Indicator", "id": "d0a59537-e7cd-46eb-a0b5-ca0858b22741", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--7bb92e88-dbfb-5104-93ee-049b8908df95", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.296Z", "created_at": "2026-09-29T19:45:15.243Z", "modified": "2026-09-29T19:45:15.397Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:15.397Z" }, "description_available": false, "entity_type": "indicates", "fromId": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "from_id": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "from_name": null, "from_type": "Indicator", "id": "d2287bc6-2b27-4745-a188-e01551f7f784", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--b344ace8-d899-5985-b55b-293b673fbf6b", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.977Z", "created_at": "2026-09-29T19:41:28.376Z", "modified": "2026-09-29T19:41:29.189Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:29.189Z" }, "description_available": false, "entity_type": "based-on", "fromId": "419aa075-2a26-4366-98bd-1d28895faea0", "from_id": "419aa075-2a26-4366-98bd-1d28895faea0", "from_name": null, "from_type": "Indicator", "id": "d278314b-513d-4c2c-940a-45518da9a6f5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--47c97961-7471-53c8-b9a5-b38418128d82", "toId": "51f928c7-031f-49f1-8c12-d39c6b59c5c6", "to_id": "51f928c7-031f-49f1-8c12-d39c6b59c5c6", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.300Z", "created_at": "2026-09-29T19:45:16.814Z", "modified": "2026-09-29T19:45:16.972Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:16.972Z" }, "description_available": false, "entity_type": "indicates", "fromId": "558472d4-6c8d-480c-8bc4-4d5be4461366", "from_id": "558472d4-6c8d-480c-8bc4-4d5be4461366", "from_name": null, "from_type": "Indicator", "id": "d8496ac1-23ff-44d6-bb0a-6436f835d80b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--3fc0119e-1643-5438-89a1-60adeec30a8b", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.427Z", "created_at": "2026-09-29T19:47:52.435Z", "modified": "2026-09-29T19:47:52.618Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:52.618Z" }, "description_available": false, "entity_type": "indicates", "fromId": "89672631-bf05-4331-be3c-bca41b144819", "from_id": "89672631-bf05-4331-be3c-bca41b144819", "from_name": null, "from_type": "Indicator", "id": "d8a6d94e-c821-47cb-9890-ffff9dc97679", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--169438b6-ea46-5ce8-a827-f3bda9cc2b0c", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.312Z", "created_at": "2026-09-29T19:45:35.648Z", "modified": "2026-09-29T19:45:36.383Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:36.383Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "from_id": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "from_name": null, "from_type": "Indicator", "id": "da2344ea-13c9-4775-82f2-df61842a2f2a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--e0a78777-e062-5017-8299-6ab2c5cc09b8", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.965Z", "created_at": "2026-09-29T19:41:25.177Z", "modified": "2026-09-29T19:41:26.818Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:26.818Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "from_id": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "from_name": null, "from_type": "Indicator", "id": "dd29417b-7180-4262-a02e-20053146ba29", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--04e2b5d7-91b6-5481-b4dd-4b3b3d72a582", "toId": "a0f835c9-bbef-4513-b82b-d94d39bd9b59", "to_id": "a0f835c9-bbef-4513-b82b-d94d39bd9b59", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.312Z", "created_at": "2026-09-29T19:45:39.576Z", "modified": "2026-09-29T19:45:39.746Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:39.746Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "from_id": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "from_name": null, "from_type": "Indicator", "id": "e0659e46-2caf-4520-b919-336152cc55a3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--ac46538e-7f8f-5d00-9256-659d8b100803", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.441Z", "created_at": "2026-09-29T19:48:12.086Z", "modified": "2026-09-29T19:48:12.290Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:48:12.290Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "from_id": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "from_name": null, "from_type": "Indicator", "id": "e1d0d97b-1d83-42b6-9571-962398281484", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--0aa1b11d-f09f-583d-a0f4-6d5727d65b19", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.012Z", "created_at": "2026-09-29T19:41:33.394Z", "modified": "2026-09-29T19:41:33.765Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:33.765Z" }, "description_available": false, "entity_type": "based-on", "fromId": "437daf69-9c68-4ede-8358-068a0f7441a7", "from_id": "437daf69-9c68-4ede-8358-068a0f7441a7", "from_name": null, "from_type": "Indicator", "id": "e4db8b90-b8d3-4227-9a4d-4d6890862eaf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--9634412c-4561-5a08-a4ae-62b85d26786e", "toId": "09d9057d-0587-4841-9bef-59a14ef205ed", "to_id": "09d9057d-0587-4841-9bef-59a14ef205ed", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.352Z", "created_at": "2026-09-29T19:46:21.707Z", "modified": "2026-09-29T19:46:22.090Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:22.090Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "from_id": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "from_name": null, "from_type": "Indicator", "id": "e85f11af-ca78-4780-a58e-12e2e431bb08", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--c7902bf9-77f2-5eda-ac1a-96a31888691b", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.338Z", "created_at": "2026-09-29T19:46:10.994Z", "modified": "2026-09-29T19:46:11.208Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:46:11.208Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "from_id": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "from_name": null, "from_type": "Indicator", "id": "e8f72bdc-37cc-4dd0-bd07-6c572f0b627f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--06207ba4-d7e1-5486-b279-f44ea5560b72", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.214Z", "created_at": "2026-09-29T19:44:06.354Z", "modified": "2026-09-29T19:44:06.597Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:06.597Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "from_id": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "from_name": null, "from_type": "Indicator", "id": "e90d5dae-8610-473c-a1b2-76474e4199e9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--6aa5feb9-2eed-5662-a4c1-4a7687ca93ea", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:48:01.518Z", "created_at": "2026-03-14T10:20:02.385Z", "modified": "2026-03-14T10:20:03.764Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-14T10:20:03.764Z" }, "description_available": false, "entity_type": "uses", "fromId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "from_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "from_name": "SectopRAT", "from_type": "Malware", "id": "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--15da5603-8d08-5327-9d1f-51f76b77813f", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.214Z", "created_at": "2026-09-29T19:44:04.100Z", "modified": "2026-09-29T19:44:04.433Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:44:04.433Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "from_id": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "from_name": null, "from_type": "Indicator", "id": "ee602253-8526-4a31-be41-5780e01c2ebd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--708744f4-4b51-5a02-9f48-9231b7e93234", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.054Z", "created_at": "2026-09-29T19:42:16.375Z", "modified": "2026-09-29T19:42:19.021Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:42:19.021Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b1bfe61e-0534-404a-9f55-67decbc49b74", "from_id": "b1bfe61e-0534-404a-9f55-67decbc49b74", "from_name": null, "from_type": "Indicator", "id": "eea92153-d675-4447-9528-ad75ad91b408", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--12760eae-9a7c-5603-9647-10a752f884e3", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.391Z", "created_at": "2026-09-29T19:47:13.394Z", "modified": "2026-09-29T19:47:13.733Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:13.733Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "from_id": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "from_name": null, "from_type": "Indicator", "id": "f0b878b9-bc69-46d0-88f0-7e687d4c14cb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--a0483640-a11d-561f-8004-105850776b4a", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:13.988Z", "created_at": "2026-09-29T19:41:29.854Z", "modified": "2026-09-29T19:41:30.355Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:30.355Z" }, "description_available": false, "entity_type": "based-on", "fromId": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "from_id": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "from_name": null, "from_type": "Indicator", "id": "f59a1d6d-40f5-4ec1-b178-c44ebd8ee872", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--7a55dad5-d539-5534-8a0b-abfee76d1474", "toId": "d2d736cb-7737-4a82-a648-d9a42c099973", "to_id": "d2d736cb-7737-4a82-a648-d9a42c099973", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.299Z", "created_at": "2026-09-29T19:45:25.544Z", "modified": "2026-09-29T19:45:25.682Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:45:25.682Z" }, "description_available": false, "entity_type": "indicates", "fromId": "558472d4-6c8d-480c-8bc4-4d5be4461366", "from_id": "558472d4-6c8d-480c-8bc4-4d5be4461366", "from_name": null, "from_type": "Indicator", "id": "f7b282f8-9125-403f-893f-7ae75b5df57d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--0f32a0b2-9f69-5aef-86d4-7ae0767fceff", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.029Z", "created_at": "2026-09-29T19:41:38.088Z", "modified": "2026-09-29T19:41:38.271Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:38.271Z" }, "description_available": false, "entity_type": "indicates", "fromId": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "from_id": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "from_name": null, "from_type": "Indicator", "id": "fa550f69-c39b-424e-8185-2485f8745a58", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--d1065a2a-3d4f-51e8-a297-c18474c5f341", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.390Z", "created_at": "2026-09-29T19:47:15.927Z", "modified": "2026-09-29T19:47:16.170Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:47:16.170Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "from_id": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "from_name": null, "from_type": "Indicator", "id": "fbefb6ff-f807-488a-9c1c-294e51326c0a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--db511082-5cbb-57c5-acb7-5b109c08a37d", "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "to_name": "SectopRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T19:40:14.041Z", "created_at": "2026-09-29T19:41:50.253Z", "modified": "2026-09-29T19:41:50.899Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-29T19:41:50.899Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "from_id": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "from_name": null, "from_type": "Indicator", "id": "fcdc7db6-c2ae-4de7-9d83-5900c9f39648", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--28a4b509-d8d7-5ce1-8625-99c4d72db892", "toId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "to_name": "MacSync", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "96[.]62[.]224[.]81", "description_available": false, "object_id": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "object_ids": [ "134c3744-0eb9-4fc5-8a63-91efd94bd964", "ef793641-63ac-4373-b1a8-ed0d416c5fbb" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ef793641-63ac-4373-b1a8-ed0d416c5fbb", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2026-10-19T06:29:25.434Z", "validity_status": "active", "value": "96.62.224.81" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "134c3744-0eb9-4fc5-8a63-91efd94bd964", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "96.62.224.81" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "ipv4", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2026-10-19T06:29:25.434Z", "validity_status": "active", "value": "96.62.224.81" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "6ab595ad6554819181b686d4876efb80", "description_available": false, "object_id": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "object_ids": [ "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "86588ec3-ad63-4e70-8458-24d163be8702" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0c2f4ada-418b-441c-86c7-6d3a3ceb0c24", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "6ab595ad6554819181b686d4876efb80" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "86588ec3-ad63-4e70-8458-24d163be8702", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "6ab595ad6554819181b686d4876efb80" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "md5", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "6ab595ad6554819181b686d4876efb80" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "6ab6ba039440819185ed491740b11cf8", "description_available": false, "object_id": "b1bfe61e-0534-404a-9f55-67decbc49b74", "object_ids": [ "b1bfe61e-0534-404a-9f55-67decbc49b74", "b288fc28-6061-47a0-b5a4-11a26c4ae3ea" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b1bfe61e-0534-404a-9f55-67decbc49b74", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "6ab6ba039440819185ed491740b11cf8" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b288fc28-6061-47a0-b5a4-11a26c4ae3ea", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "6ab6ba039440819185ed491740b11cf8" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "md5", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "6ab6ba039440819185ed491740b11cf8" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f", "description_available": false, "object_id": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "object_ids": [ "a0f835c9-bbef-4513-b82b-d94d39bd9b59", "e8238020-7d38-4ec0-8431-5db1fe06ffb4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e8238020-7d38-4ec0-8431-5db1fe06ffb4", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "a0f835c9-bbef-4513-b82b-d94d39bd9b59", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335", "description_available": false, "object_id": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "object_ids": [ "09d6e6f1-fbec-469a-9380-23eb3df2936f", "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a62e37f3-dce1-4fd8-8a09-d55d7cbedb30", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "09d6e6f1-fbec-469a-9380-23eb3df2936f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53", "description_available": false, "object_id": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "object_ids": [ "22cee9ca-2bc7-4022-8b00-872ee5d688c9", "f7de82a6-89d9-433e-b86a-5e25376d9e50" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f7de82a6-89d9-433e-b86a-5e25376d9e50", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "22cee9ca-2bc7-4022-8b00-872ee5d688c9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4", "description_available": false, "object_id": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "object_ids": [ "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "f3013048-3cde-4d5c-bb3d-7cd5df8a91b5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "918bc76d-6e4e-488c-932f-4cea1c16eb3b", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f3013048-3cde-4d5c-bb3d-7cd5df8a91b5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48", "description_available": false, "object_id": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "object_ids": [ "7138f3a9-18f8-49ea-bd26-00ea35887e39", "aea30c34-b766-4fbd-8a32-78d41a5c347f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "aea30c34-b766-4fbd-8a32-78d41a5c347f", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "7138f3a9-18f8-49ea-bd26-00ea35887e39", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621", "description_available": false, "object_id": "419aa075-2a26-4366-98bd-1d28895faea0", "object_ids": [ "419aa075-2a26-4366-98bd-1d28895faea0", "51f928c7-031f-49f1-8c12-d39c6b59c5c6" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "419aa075-2a26-4366-98bd-1d28895faea0", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "51f928c7-031f-49f1-8c12-d39c6b59c5c6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31", "description_available": false, "object_id": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "object_ids": [ "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "62637fd3-c32b-4998-a6da-70e159ba2ed5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "24d2c09e-26bd-4ad2-8518-94cb4b8cd022", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "62637fd3-c32b-4998-a6da-70e159ba2ed5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc", "description_available": false, "object_id": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "object_ids": [ "05a8cb78-9db0-4ca5-9cce-aac8f6b86732", "4c868f9f-ce34-4162-a903-7cf7fed3e2a3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4c868f9f-ce34-4162-a903-7cf7fed3e2a3", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "05a8cb78-9db0-4ca5-9cce-aac8f6b86732", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2", "description_available": false, "object_id": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "object_ids": [ "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "d2d736cb-7737-4a82-a648-d9a42c099973" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "46afab6c-8a67-42c3-9f04-b09c68ac3dff", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d2d736cb-7737-4a82-a648-d9a42c099973", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d", "description_available": false, "object_id": "558472d4-6c8d-480c-8bc4-4d5be4461366", "object_ids": [ "37ad0eff-2efe-4493-88c8-364c6f3027e9", "558472d4-6c8d-480c-8bc4-4d5be4461366" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "558472d4-6c8d-480c-8bc4-4d5be4461366", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "37ad0eff-2efe-4493-88c8-364c6f3027e9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6", "description_available": false, "object_id": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "object_ids": [ "cfce6bb6-0f73-4823-b7c0-6d057ea52999", "f71c8764-c9d0-43d5-a253-a57cd5584ec6" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f71c8764-c9d0-43d5-a253-a57cd5584ec6", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "cfce6bb6-0f73-4823-b7c0-6d057ea52999", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907", "description_available": false, "object_id": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "object_ids": [ "33f0a556-cb64-4fea-b428-943905d8a83f", "7db8b012-1bf1-47d2-b3fd-61dec812de7d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7db8b012-1bf1-47d2-b3fd-61dec812de7d", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "33f0a556-cb64-4fea-b428-943905d8a83f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4", "description_available": false, "object_id": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "object_ids": [ "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "b4741383-69d5-47fa-be3f-d9c34165e433" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4b56fb9a-1a08-4fdf-82ab-a462cbc901d8", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b4741383-69d5-47fa-be3f-d9c34165e433", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe", "description_available": false, "object_id": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "object_ids": [ "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "b88d400e-b325-4adc-adbd-cb99c932cd0c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0e3eac41-9dbf-4812-b319-2101e02b9eb6", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b88d400e-b325-4adc-adbd-cb99c932cd0c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7", "description_available": false, "object_id": "f65fad38-008d-4798-a6d5-0668b6a4a357", "object_ids": [ "0c678156-bb94-4f15-9b9f-e4fddc2a2597", "f65fad38-008d-4798-a6d5-0668b6a4a357" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f65fad38-008d-4798-a6d5-0668b6a4a357", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0c678156-bb94-4f15-9b9f-e4fddc2a2597", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e", "description_available": false, "object_id": "437daf69-9c68-4ede-8358-068a0f7441a7", "object_ids": [ "09d9057d-0587-4841-9bef-59a14ef205ed", "437daf69-9c68-4ede-8358-068a0f7441a7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "437daf69-9c68-4ede-8358-068a0f7441a7", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "09d9057d-0587-4841-9bef-59a14ef205ed", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90", "description_available": false, "object_id": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "object_ids": [ "69546ee3-8cb3-43e5-94c9-4a245058ff77", "ee3f27a9-1bd1-4c35-aa86-69e128f29944" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ee3f27a9-1bd1-4c35-aa86-69e128f29944", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "69546ee3-8cb3-43e5-94c9-4a245058ff77", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb", "description_available": false, "object_id": "917a8437-2546-4e5d-b547-8baa42eb118e", "object_ids": [ "63b18b02-2cdb-45f3-8aae-166807dbca09", "917a8437-2546-4e5d-b547-8baa42eb118e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "917a8437-2546-4e5d-b547-8baa42eb118e", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "63b18b02-2cdb-45f3-8aae-166807dbca09", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b", "description_available": false, "object_id": "29cb4f54-0a74-4e20-966d-680edd27822f", "object_ids": [ "29cb4f54-0a74-4e20-966d-680edd27822f", "e1c1e75e-1686-462f-8acf-da3bfbdfa058" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "29cb4f54-0a74-4e20-966d-680edd27822f", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "e1c1e75e-1686-462f-8acf-da3bfbdfa058", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764", "description_available": false, "object_id": "89672631-bf05-4331-be3c-bca41b144819", "object_ids": [ "89672631-bf05-4331-be3c-bca41b144819", "8ca5bd1a-5763-47c9-8b93-26822d4292fa" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "89672631-bf05-4331-be3c-bca41b144819", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "8ca5bd1a-5763-47c9-8b93-26822d4292fa", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764" } ], "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "type": "sha256", "valid_from": "2026-09-29T00:54:46.000Z", "valid_until": "2027-07-16T12:04:30.557Z", "validity_status": "active", "value": "eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764" } ], "mentioned": [ { "confidence": 50, "evidence_id": "ea4de683-0cad-4497-a044-65b61045d534", "name": "T1574.002", "role": "mentionné", "type": "Attack-Pattern" }, { "confidence": 50, "evidence_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "name": "MacSync", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "name": "SectopRAT", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:48:01.509Z", "created_at": "2026-03-14T10:19:57.852Z", "modified": "2026-03-14T10:19:59.637Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-14T10:19:59.637Z" }, "description_available": false, "entity_type": "uses", "fromId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "from_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "from_name": "SectopRAT", "from_type": "Malware", "id": "73d62ff6-1791-46ae-b8a5-1d33140607e8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--5a02ab15-90ae-51c3-8232-7f950aff74b6", "toId": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0", "to_id": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0", "to_name": "T1085", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:48:01.518Z", "created_at": "2026-03-14T10:20:02.385Z", "modified": "2026-03-14T10:20:03.764Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-14T10:20:03.764Z" }, "description_available": false, "entity_type": "uses", "fromId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "from_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "from_name": "SectopRAT", "from_type": "Malware", "id": "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--15da5603-8d08-5327-9d1f-51f76b77813f", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1085" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:02:56.967Z", "created_by": null, "dates": { "created": "2026-01-18T18:02:56.967Z", "created_at": "2026-01-18T18:20:24.501Z", "modified": "2026-01-18T18:20:26.536Z", "updated_at": "2026-01-18T18:20:26.536Z" }, "description_available": false, "evidence_ids": [ "73d62ff6-1791-46ae-b8a5-1d33140607e8", "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0" ], "external_id": "T1085", "id": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1085", "modified": "2026-01-18T18:20:26.536Z", "name": "T1085", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1085", "id": "584a166f-e9d7-4867-b842-dcf1ba7a5aaf", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1085" } ], "relationship_ids": [ "73d62ff6-1791-46ae-b8a5-1d33140607e8" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "tactics": [], "url": "https://attack.mitre.org/techniques/T1085/", "via_entities": [ { "id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "name": "SectopRAT", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "name": "SectopRAT", "type": "Malware" } ] } ], "via_entity": { "id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "name": "SectopRAT", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.570Z", "created_at": "2026-09-26T12:07:44.431Z", "modified": "2026-09-26T12:07:45.134Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:45.134Z" }, "description_available": false, "entity_type": "uses", "fromId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_name": "AMOS", "from_type": "Malware", "id": "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--beaed072-c988-5837-b512-383f4ecfa981", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:30:15.781Z", "created_at": "2026-04-21T13:42:31.696Z", "modified": "2026-04-21T13:42:32.538Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-21T13:42:32.538Z" }, "description_available": false, "entity_type": "uses", "fromId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_name": "AMOS", "from_type": "Malware", "id": "b3ef85a7-87b7-4982-8d5b-7358f6e2296b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--60a5ab56-308d-557a-888a-182d713fc081", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:03:20.926Z", "created_at": "2026-03-05T15:27:09.826Z", "modified": "2026-03-05T15:27:10.237Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-05T15:27:10.237Z" }, "description_available": false, "entity_type": "uses", "fromId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_name": "AMOS", "from_type": "Malware", "id": "d376288d-a101-4cc9-9473-6bbc0d40c47c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--4a2cb37a-102a-597b-ba51-a5892068d4dc", "toId": "0c43fa3c-1023-4011-bc40-c398438711c9", "to_id": "0c43fa3c-1023-4011-bc40-c398438711c9", "to_name": "T1094", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1094" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:04:28.695Z", "created_by": null, "dates": { "created": "2026-01-18T18:04:28.695Z", "created_at": "2026-01-18T22:32:58.220Z", "modified": "2026-01-18T22:33:01.087Z", "updated_at": "2026-01-18T22:33:01.087Z" }, "description_available": false, "evidence_ids": [ "0c43fa3c-1023-4011-bc40-c398438711c9", "d376288d-a101-4cc9-9473-6bbc0d40c47c" ], "external_id": "T1094", "id": "0c43fa3c-1023-4011-bc40-c398438711c9", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1094", "modified": "2026-01-18T22:33:01.087Z", "name": "T1094", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1094", "id": "fb43a6ff-5bf1-40b3-8e1c-ce8220f7163b", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1094" } ], "relationship_ids": [ "d376288d-a101-4cc9-9473-6bbc0d40c47c" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "tactics": [], "url": "https://attack.mitre.org/techniques/T1094/", "via_entities": [ { "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1547.011" }, "authorized_members": [], "confidence": 50, "created": "2026-02-24T07:08:28.227Z", "created_by": null, "dates": { "created": "2026-02-24T07:08:28.227Z", "created_at": "2026-04-23T03:32:45.532Z", "modified": "2026-04-23T03:32:46.001Z", "updated_at": "2026-04-23T03:32:46.001Z" }, "description_available": false, "evidence_ids": [ "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0" ], "external_id": "T1547.011", "id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1547.011", "modified": "2026-04-23T03:32:46.001Z", "name": "T1547.011", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1547.011", "id": "62847de4-ffae-4ca9-9509-aaed8ebdfb97", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1547/011" } ], "relationship_ids": [ "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "tactics": [], "url": "https://attack.mitre.org/techniques/T1547/011/", "via_entities": [ { "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "b3ef85a7-87b7-4982-8d5b-7358f6e2296b", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "b3ef85a7-87b7-4982-8d5b-7358f6e2296b" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "type": "Malware" } ] } ], "via_entity": { "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:30:15.771Z", "created_at": "2026-04-21T13:42:18.491Z", "modified": "2026-04-21T13:42:18.927Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-21T13:42:18.927Z" }, "description_available": false, "entity_type": "uses", "fromId": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "from_name": "MacSync", "from_type": "Malware", "id": "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "standard_id": "relationship--25ba721f-0c28-5c46-984c-a72f9063c358", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "name": "MacSync", "type": "Malware" } ] } ], "via_entity": { "id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "name": "MacSync", "type": "Malware" } } ], "direct_techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "0706aac1-90d3-47aa-875c-0f18604584b2", "112c1507-feda-4a35-b7a0-7c715e524d7d", "157503b3-30c4-49f4-a330-7aa78ea0838d", "171be573-1460-43eb-a7a6-3617cf71e594", "24313ec4-36dc-4f11-b623-13a6208324b7", "249b43eb-7173-4460-9ccf-0e654bda4c35", "278077c8-462b-45b5-b288-56084c2cc257", "30e2d168-6b0a-4778-b028-992ed2b090c9", "466cb4b9-21b3-4a8a-ac2b-6a2720cdd8c7", "5a339ede-350b-4382-ba4d-6c41a643fe35", "5e44adae-c35a-440a-84d3-6bd7dc77615d", "5f284871-d861-4b22-b94b-82aa97d68e4d", "6156b419-01b0-4020-8216-6af65c2bfb20", "6b26ae77-21d6-4903-9eea-0939e9835b19", "846b38a0-ce68-4100-85a3-286c3424f6dc", "8690be99-db4f-4613-99d7-ed35f5b1ce3f", "9069b65e-8189-4604-a084-ae82ff9ae5c5", "938557b0-e68a-4f4b-b0b2-111cedb385ea", "9c95f37a-94c6-489e-9d39-5a152f4fe290", "aa2139aa-9650-455a-a2fd-6a591caaf745", "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7", "b554efc6-2e2c-45c3-9dca-89810f14f447", "b9804c4d-e4ca-49d9-8a6b-4c20a77a696a", "d2287bc6-2b27-4745-a188-e01551f7f784", "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "0706aac1-90d3-47aa-875c-0f18604584b2", "112c1507-feda-4a35-b7a0-7c715e524d7d", "157503b3-30c4-49f4-a330-7aa78ea0838d", "171be573-1460-43eb-a7a6-3617cf71e594", "24313ec4-36dc-4f11-b623-13a6208324b7", "249b43eb-7173-4460-9ccf-0e654bda4c35", "278077c8-462b-45b5-b288-56084c2cc257", "30e2d168-6b0a-4778-b028-992ed2b090c9", "466cb4b9-21b3-4a8a-ac2b-6a2720cdd8c7", "5a339ede-350b-4382-ba4d-6c41a643fe35", "5e44adae-c35a-440a-84d3-6bd7dc77615d", "5f284871-d861-4b22-b94b-82aa97d68e4d", "6156b419-01b0-4020-8216-6af65c2bfb20", "6b26ae77-21d6-4903-9eea-0939e9835b19", "846b38a0-ce68-4100-85a3-286c3424f6dc", "8690be99-db4f-4613-99d7-ed35f5b1ce3f", "9069b65e-8189-4604-a084-ae82ff9ae5c5", "938557b0-e68a-4f4b-b0b2-111cedb385ea", "9c95f37a-94c6-489e-9d39-5a152f4fe290", "aa2139aa-9650-455a-a2fd-6a591caaf745", "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7", "b554efc6-2e2c-45c3-9dca-89810f14f447", "b9804c4d-e4ca-49d9-8a6b-4c20a77a696a", "d2287bc6-2b27-4745-a188-e01551f7f784", "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d" ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "name": "SectopRAT", "type": "Malware" }, { "id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "name": "MacSync", "type": "Malware" } ] } ], "official_catalog": { "complete": true, "fetched_at": "2026-10-10T22:52:12Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "1.2", "canonical_url": "https://attack.mitre.org/techniques/T1085/", "created": "2017-05-31T21:31:06.045Z", "deprecated": false, "matched": true, "mitre_id": "T1085", "modified": "2026-04-14T22:53:14.952Z", "official_name": "Rundll32", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1218/011/", "mitre_id": "T1218.011", "official_name": "Rundll32", "official_status": "active", "relationship_id": "relationship--4d7a9d82-1400-42bd-982a-3e0e4d9396fa", "stix_id": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5" } ], "revoked": true, "stix_id": "attack-pattern--62b8c999-dcc0-4755-bd69-09442d9359f5" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1094/", "created": "2017-05-31T21:31:10.314Z", "deprecated": false, "matched": true, "mitre_id": "T1094", "modified": "2025-10-24T17:49:37.745Z", "official_name": "Custom Command and Control Protocol", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0011", "name": "Command and Control", "shortname": "command-and-control" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1095/", "mitre_id": "T1095", "official_name": "Non-Application Layer Protocol", "official_status": "active", "relationship_id": "relationship--e4a43af9-e8f0-42cf-a707-b2393efb44f5", "stix_id": "attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b" } ], "revoked": true, "stix_id": "attack-pattern--f72eb8a8-cd4c-461d-a814-3f862befbf00" }, { "attack_version": "1.2", "canonical_url": "https://attack.mitre.org/techniques/T1547/011/", "created": "2020-01-24T20:02:59.149Z", "deprecated": false, "matched": true, "mitre_id": "T1547.011", "modified": "2025-10-24T17:48:53.190Z", "official_name": "Plist Modification", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0003", "name": "Persistence", "shortname": "persistence" }, { "mitre_id": "TA0004", "name": "Privilege Escalation", "shortname": "privilege-escalation" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1647/", "mitre_id": "T1647", "official_name": "Plist File Modification", "official_status": "active", "relationship_id": "relationship--6f75a833-d53e-41bb-942b-cef4f3f076c3", "stix_id": "attack-pattern--7d20fff9-8751-404e-badd-ccd71bda0236" } ], "revoked": true, "stix_id": "attack-pattern--6747daa2-3533-4e78-8fb8-446ebb86448a" }, { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-29T00:54:45.808Z", "created_at": "2026-09-29T19:48:51.391Z", "modified": "2026-09-29T19:49:02.579Z", "published": "2026-09-29T00:54:45.808Z", "updated_at": "2026-09-29T19:49:02.579Z" }, "description_available": true, "id": "8a3c5b6c-8ce3-4e99-9661-6eadb48fe241", "is_inferred": false, "labels": [ "amos", "canon sideloading", "chatgpt custom gpt", "clickfix", "dll sideloading", "google sites abuse", "lumma stealer", "macsync", "powershell obfuscation", "rat deployment", "sectoprat", "social engineering" ], "lang": "en", "name": "Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-29T00:54:45.808Z", "references": [ { "external_id": null, "id": "ca944ba3-2022-45fd-9a67-7df561616bf6", "source_name": "alien-vault", "url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat" }, { "external_id": "6abb0c55e0fed2d6a1f7e51a", "id": "2c7fb2e8-6ee9-442d-8491-a3b255f84f7a", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6abb0c55e0fed2d6a1f7e51a" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat" }, "targets": [], "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "0706aac1-90d3-47aa-875c-0f18604584b2", "112c1507-feda-4a35-b7a0-7c715e524d7d", "157503b3-30c4-49f4-a330-7aa78ea0838d", "171be573-1460-43eb-a7a6-3617cf71e594", "24313ec4-36dc-4f11-b623-13a6208324b7", "249b43eb-7173-4460-9ccf-0e654bda4c35", "278077c8-462b-45b5-b288-56084c2cc257", "30e2d168-6b0a-4778-b028-992ed2b090c9", "466cb4b9-21b3-4a8a-ac2b-6a2720cdd8c7", "5a339ede-350b-4382-ba4d-6c41a643fe35", "5e44adae-c35a-440a-84d3-6bd7dc77615d", "5f284871-d861-4b22-b94b-82aa97d68e4d", "6156b419-01b0-4020-8216-6af65c2bfb20", "6b26ae77-21d6-4903-9eea-0939e9835b19", "846b38a0-ce68-4100-85a3-286c3424f6dc", "8690be99-db4f-4613-99d7-ed35f5b1ce3f", "9069b65e-8189-4604-a084-ae82ff9ae5c5", "938557b0-e68a-4f4b-b0b2-111cedb385ea", "9c95f37a-94c6-489e-9d39-5a152f4fe290", "aa2139aa-9650-455a-a2fd-6a591caaf745", "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7", "b554efc6-2e2c-45c3-9dca-89810f14f447", "b9804c4d-e4ca-49d9-8a6b-4c20a77a696a", "d2287bc6-2b27-4745-a188-e01551f7f784", "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "0706aac1-90d3-47aa-875c-0f18604584b2", "112c1507-feda-4a35-b7a0-7c715e524d7d", "157503b3-30c4-49f4-a330-7aa78ea0838d", "171be573-1460-43eb-a7a6-3617cf71e594", "24313ec4-36dc-4f11-b623-13a6208324b7", "249b43eb-7173-4460-9ccf-0e654bda4c35", "278077c8-462b-45b5-b288-56084c2cc257", "30e2d168-6b0a-4778-b028-992ed2b090c9", "466cb4b9-21b3-4a8a-ac2b-6a2720cdd8c7", "5a339ede-350b-4382-ba4d-6c41a643fe35", "5e44adae-c35a-440a-84d3-6bd7dc77615d", "5f284871-d861-4b22-b94b-82aa97d68e4d", "6156b419-01b0-4020-8216-6af65c2bfb20", "6b26ae77-21d6-4903-9eea-0939e9835b19", "846b38a0-ce68-4100-85a3-286c3424f6dc", "8690be99-db4f-4613-99d7-ed35f5b1ce3f", "9069b65e-8189-4604-a084-ae82ff9ae5c5", "938557b0-e68a-4f4b-b0b2-111cedb385ea", "9c95f37a-94c6-489e-9d39-5a152f4fe290", "aa2139aa-9650-455a-a2fd-6a591caaf745", "ab5dfa3b-0b5e-4cce-961f-9df9a8fc41f7", "b554efc6-2e2c-45c3-9dca-89810f14f447", "b9804c4d-e4ca-49d9-8a6b-4c20a77a696a", "d2287bc6-2b27-4745-a188-e01551f7f784", "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d" ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0", "name": "SectopRAT", "type": "Malware" }, { "id": "b6742563-4a94-4e65-be91-2fd195fa79cc", "name": "MacSync", "type": "Malware" } ] } ], "vulnerabilities": [] }, "report_id": "8a3c5b6c-8ce3-4e99-9661-6eadb48fe241", "schema_version": 1, "selected_date": "2026-09-29", "source_url": "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat" }