Filed under: Cybersecurity · Phishing · October 2026

What happened

Security firm Huntress found criminals buying Google ads for the search term “ChatGPT.” The ad leads to a real chatgpt.com page, but it’s a fake custom chatbot called “Plus 5.6” that tells every visitor ChatGPT is down and points them to a “backup site.” That site shows a fake Cloudflare “verify you are human” check that asks you to copy a command and paste it into Windows. Doing so quietly installs a remote access trojan that lets the attacker watch the screen, take over the PC, turn on the webcam and microphone, search files, and install more malware. Huntress has responded to at least 40 infections. OpenAI removed the first fake chatbot on September 25, and a second one turned up two days later.

Why it matters to your business

Plenty of employees now use ChatGPT every day, and many get there by typing “chatgpt” into Google and clicking the first result, which is often an ad. This scam is convincing because it really does start on chatgpt.com, so the usual advice to “check the address bar” doesn’t help at first. One infected office PC gives an attacker a live view of everything that person does, including logins for banking, QuickBooks, payroll, and Microsoft 365. The malware also hides itself from the Windows installed-apps list and reinstalls its startup entries if you delete them.

What to do this week

1. Tell your team the one rule that stops this whole family of attacks: no real website will ever ask you to paste a command into Windows. If a “verify you are human” page tells you to press Windows key + R, open PowerShell, or paste anything, close the tab and let IT know.
2. Have staff reach AI tools from a bookmark (https://chatgpt.com, or Copilot at https://m365.cloud.microsoft) rather than through Google. Teach them to skip results labeled “Sponsored.” Also tell them a “backup site” for a major service is a red flag.
3. Check PCs for signs of infection: open Task Manager → Startup apps and Task Scheduler → Task Scheduler Library and look for an entry named “Canon Configuration Reader” or “Stardock DeElevation Tool.” Also look for a folder at %LOCALAPPDATA%\Programs\Advanced Printer Configuration Reader or %LOCALAPPDATA%\Programs\Stardock Smart DeElevation Tool. If you find any of these, unplug the PC from the network and call your IT provider. Then change that user’s passwords from a different, clean device.
4. If you have Group Policy or Intune, think about removing the Run dialog for regular users (User Configuration → Administrative Templates → Start Menu and Taskbar → Remove Run menu from Start Menu) and limiting PowerShell for people who don’t need it. Either change removes the easiest path this scam relies on.
5. Make sure Microsoft Defender or your endpoint protection is turned on and reporting on every PC. Run a full scan on any machine whose user remembers seeing a “ChatGPT is down” message recently.

The bigger picture

These copy-and-paste “fix it” scams (security researchers call them ClickFix) keep showing up in new places: fake CAPTCHAs, fake Teams errors, and now fake AI chatbots. Your antivirus can’t stop an employee from running a command themselves, so the most reliable protection is a team that knows the warning signs. → Phishing Attacks: Why SMBs Are Prime Targets and How to Fight Back

Do you know which AI tools your team is using, and how they find them? Book a free consult → https://micro1tech.com/contact/