Clicked a fake verification prompt? Check what ran next.

What was reported

Huntress documented a campaign that sent users from attacker-created Custom GPTs to fake verification pages. The prompts persuaded people to run PowerShell, installing a remote access trojan. Its October 14 update reported continuing activity and changing lure domains.

In the investigated variants, the malware used legitimate Canon or Stardock programs to load malicious code. A registry Run entry and a scheduled task maintained access. In one incident, Defender quarantined the installer after execution, while persistence remained. Read Huntress's investigation and current indicators.

First steps

Tell your IT provider whether you only opened the page, downloaded a file, or ran a command. Record the approximate time, the account used, and the page address. Keep the original message or browser history; do not revisit the lure to reconstruct it.

If a command ran or a security alert appeared, stop using the computer for work and ask IT to isolate it. Use a separate, trusted device to contact support and handle account recovery. An IT responder should preserve the process and connection evidence before cleanup or a reboot.

What IT should check

• Trace the process chain around the reported time, including PowerShell, Windows Installer, and newly created files. Preserve the original alert and command line.
• Inspect scheduled tasks and user Run entries together. The reported variants used matching names such as Canon Configuration Reader or Stardock DeElevation Tool; compare paths and hashes with the source report.
• Check for later payloads, other affected users, and sign-ins from unexpected devices. A quarantined download is only one part of the timeline.

Before returning to work

Remove confirmed persistence as part of a reviewed incident plan, or rebuild from trusted media when the extent of access is uncertain. Do not delete Canon or Stardock software solely because its name appears here; this campaign abuses legitimate programs.

Review accounts used on the affected computer, revoke exposed sessions and credentials from a clean device, and verify that endpoint protection is running and reporting. Record who checked the rebuilt or cleaned device and when it can reconnect.