Huntress tracked a campaign that abuses Custom GPTs on the legitimate ChatGPT domain to send users to a fake Cloudflare CAPTCHA (ClickFix) that runs PowerShell, downloads an MSI (often via decimal-encoded IPs), then sideloads via signed Canon/Stardock binaries. Do not blanket-block chatgpt.com or sites.google.com—hunt the specific lure paths, decimal-host PowerShell, and sideload parents instead.

// KQL sketch
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("DownloadString","IEX","mse","ISOSimple")
    or ProcessCommandLine matches regex @"\b\d{7,10}\b"  // decimal IP pattern
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine

Pair with unusual child processes of signed Canon/Stardock apps. Sketch only; validate IoCs from Huntress before blocking.