IT Daily Roundup – September 30, 2026
1. Fake ChatGPTs in Google Ads: ClickFix Attack Delivers RAT Malware
Threat actors created malicious custom ChatGPT variants promoted through paid Google search ads under the name "Plus 5.6". Clicking the ad redirected users to a fake Cloudflare CAPTCHA page hosted on Google Sites, which prompted them to run a PowerShell command — a classic ClickFix attack where the victim executes malicious code themselves "to verify they are not a robot." The PowerShell command downloaded an MSI installer that deployed a Remote Access Trojan (RAT) with full capabilities: remote desktop access, audio and camera recording, file searching, and the ability to execute additional payloads. Huntress researchers confirmed at least 40 incidents tied to the malicious page. The campaign also exploits OpenAI's planned retirement of the Custom GPT platform on December 11, framing the fake ad as an "upgrade" opportunity.
Why this matters: This campaign is a practical warning for any business whose employees regularly use ChatGPT. Attackers don't exploit a technical vulnerability — they rely on users trusting Google ads and running a command a malicious page tells them to. Remind employees: no legitimate website or AI tool ever requires running a PowerShell command "to verify identity" — this is always an attack. Consider deploying an EDR solution that monitors suspicious PowerShell executions and MSI installer launches from unknown sources.
2. Attackers Poison AI Search Results: ChatGPT and Gemini Return Fake Contact Info for Banks and Airlines
Researchers uncovered a large-scale campaign in which threat actors systematically flood the internet with pages optimized for generative AI search engines — a technique called AI search poisoning. The malicious content, consisting of fraudulent phone numbers and fake support contacts, successfully infiltrated results from ChatGPT, Google Gemini, and Google AI Overview. A total of 374 companies were affected, including major banks (Bank of America, Chase, Citi), airlines (Delta, Lufthansa, Emirates), and platforms such as Airbnb. Researchers detected tens of thousands of malicious pages serving fraudulent contact information. Attackers use obfuscation techniques — spaces, emojis, Unicode characters — to bypass spam filters, while AI models still process and surface the text as a normal result.
Why this matters: Most businesses don't protect employees from the risk of spoofed AI search results. The scenario is simple and realistic: an employee needs to contact a bank or supplier, asks ChatGPT or Gemini, and calls the number the AI returns — but that number belongs to a scammer, not the bank. The result can be exposed banking credentials, unauthorized payments, or a leak of corporate information. Recommendation: employees should always verify contacts for banks, suppliers, and critical services directly on official websites — never through AI search. A company-maintained list of verified contacts (internal phonebook or CRM entries) is more important than ever in this context.
3. First Autonomous AI Agent Deployed as an Attacker: Hackers Breach Cybersecurity Nonprofit DIVD
The Dutch Institute for Vulnerability Disclosure (DIVD) — a nonprofit that has been scanning for and disclosing vulnerabilities for seven years — fell victim to a next-generation attack. After gaining initial access through a technical vulnerability, the attacker deployed an autonomous AI agent to conduct post-exploitation activities. The AI agent operated entirely on its own: scanning systems, making decisions about next steps, and executing commands without a human operator. DIVD described the attack as "loud and very, very messy" — the agent made mistakes, commented on its own decisions, and left extensive forensic evidence that paradoxically aided investigators. DIVD has notified law enforcement and the National Cybersecurity Center. Details about the exploited vulnerability remain undisclosed; a full report is expected on October 1.
← All postsWhy this matters: This is the first publicly confirmed case of an autonomous AI agent conducting offensive activities in a real environment — not just helping write phishing emails, but actively taking over the post-exploitation phase of an attack without a human operator. For SME businesses, this signals that the era when cyberattacks required skilled operators around the clock is slowly ending: AI agents can attack at any time, continuously, and without fatigue. The good news: current implementations are still error-prone and leave traces. Recommendation: deploy security log monitoring (SIEM) and EDR with anomaly detection — not just to catch human attackers, but to identify automated behavior that differs from normal user patterns.