A Custom GPT Became the First Step in a ClickFix Malware Chain

Start with the event that turns a web lure into local execution: a user launched PowerShell, which invoked msiexec on an MSI in the temporary directory. Then inspect the installed application’s path, the DLLs loaded from that directory, and any Run key or scheduled task created soon afterward. Huntress published specific indicators, including the persistence names “Canon Configuration Reader” and “Stardock DeElevation Tool,” but it also cautioned that future variants may use different signed applications. Behavioral relationships age better than a fixed list of names.

This is a practical threat hunting problem when the first clue is a user report, a suspicious ad, or an endpoint alert with incomplete context. Nebulock describes its platform as a way to surface and investigate endpoint and identity based threats using connected telemetry. In an environment where the relevant endpoint records are available, that kind of hunting can help analysts look for related process chains and persistence across other machines. It does not remove a malicious custom GPT, block a pasted command, or replace the endpoint controls and investigation needed to confirm compromise.

For a confirmed affected host, responders should preserve evidence, isolate the endpoint as appropriate, examine the user’s account activity, and determine whether the trojan accessed sensitive data or other systems. Removing only one scheduled task is inadequate if a running implant recreates it. Huntress observed that the persistence mechanisms can be restored while the malware remains active, so cleanup must account for the process and both persistence paths.