An attacker-built Custom GPT called “Plus 5.6” appeared at a real chatgpt.com address and presented a false service notice. It pointed users to a Google Sites “backup”, where a fake Cloudflare check told them to run PowerShell. Huntress confirmed two infections that began at a Custom GPT. Its security operations centre handled at least 40 incidents tied to that Sites domain; it did not establish a GPT entry point for the rest.In some cases, a sponsored search result led to the GPT. Huntress traced the copied command to a malicious MSI, a signed Canon application loading a modified DLL, persistence and a remote access trojan. A later version used a signed Stardock host. Huntress says the first GPT was removed by 25 September; a linked replacement was active when its 28 September report appeared. That is a dated observation, not a claim of current availability or a platform breach.Does a real ChatGPT address make the instruction safe?No. OpenAI's documentation describes Custom GPTs as configurable with builder-supplied instructions. Huntress says this page identified its author as a community builder while borrowing a model-like name. The hostname showed where the page lived, not whether its “service availability” message was official.BlackTree analysis: The decisive point was the handoff from a hosted conversation to an unrelated “backup” site, then from a web check to Windows Terminal. Each change of context needs its own trust decision. A user can leave that flow and reach the service through a saved, independently obtained route. A CAPTCHA or…