Attackers abused fake ChatGPT Custom GPTs and ClickFix to deliver a multi-stage RAT, hiding payloads behind signed software.