OpenAI said it had blocked a number of ChatGPT accounts linked to state and cybercriminal groups from Russia, China, Iran and other countries that were using AI to write malicious code, automate fake campaigns and conduct cyber intelligence.
OpenAI said it had blocked a number of ChatGPT accounts linked to state and cybercriminal groups from Russia, China, Iran and other countries that were using AI to write malicious code, automate fake campaigns and conduct cyber intelligence.
This is stated in the company’s report, published on June 3. One example is a Russian-speaking group that created malware for Windows using ChatGPT, improved the code, disguised itself as legitimate software Crosshair X and infected computers to steal credentials, cookies and tokens from browsers. The stolen information was sent to Telegram.
Using a network of temporary accounts, the attackers ran one dialog on each account to gradually improve their code, demonstrating a serious level of OPSEC (operational security). Tools included Go, PowerShell, ShellExecuteW, DLL side-loading, Base64 obfuscation, and SOCKS5 proxies for IP hiding.
OpenAI also detected activity by two Chinese APT groups: APT5 and APT15. They used ChatGPT to research satellite technologies, create scripts, administer Linux, develop Android applications, and write bots for social networks — for example, automated liking of posts on TikTok, X (Twitter), and Instagram.
Another case is the Iranian operation Storm-2035, which used ChatGPT to generate comments in English and Spanish with political messages in support of Palestine, Scotland and Ireland. And the Chinese campaign Sneer Review generated posts on Facebook and Reddit about international politics in English, Chinese and Urdu.
In total, OpenAI has identified nine groups of attackers from different countries who have misused its models. They have created fake content, automated attacks on social media, and even facilitated fraudulent recruitment schemes with «entry fees.»
ChatGPT and other large language models can be used for both good and bad purposes. That’s why OpenAI is stepping up its monitoring of user activity. The company also said it’s working with partners to detect and block malicious campaigns. In this case, it’s not just about hacking attacks, but also about manipulative information operations on geopolitical topics.
We also recently wrote about a new model, ChatGPT-5, which OpenAI may announce as early as July. It is expected to be the company’s most feature-rich AI yet, with support for video, long-term memory, and a unified interface for working with text, code, and images.
