Hiding in plain sight: Fake GPTs, SMTP malware and NetScaler zero-days

Visit Security Intelligence podcast page to get more AI content → https://www.ibm.com/think/podcasts/security-intelligence That ChatGPT ad might not be from OpenAI.

On episode 54 of Security Intelligence, Michelle Alvarez, Giacomo Casoni and Norman Dorsch join our new host Patrick Austin for imposter week: three stories about attackers posing as something you trust.

First, attackers bought sponsored search ads that led to a fake “Plus 5.6” Custom GPT, which steered at least 40 victims toward a ClickFix page and a remote access trojan. The panel digs into why ClickFix keeps working, and whether AI companies should police their GPT marketplaces the way app stores do.

Then: Rapid7 found Linux backdoors, including a new BPFDoor variant and a RAT called AVERAT, hiding on the appliances that screen companies’ email. From there, attackers can see an organization's mail traffic, and their own traffic blends right in. How do you catch an imposter that looks exactly like your security tools?

Finally, suspected state-linked hackers exploit two critical flaws in Citrix NetScaler, hitting dozens of organizations across government, healthcare and critical infrastructure. Some Dutch hospitals took patient portals offline. And patching won’t evict attackers who got in first, which makes a tested playbook essential.

All that and more In Security Intelligence.

00:00 – Intro

1:35 – Fake GPTs as malware lures

7:37 – Backdoors disguised as email

13:51 – Inside the NetScaler attacks

"The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."