OpenAI has disclosed that it banned a group of ChatGPT accounts operated by Russian-speaking threat actors and Chinese state-affiliated hacking groups who were abusing the AI platform for cybercriminal and espionage activities.
According to OpenAI’s latest threat intelligence report, Russian threat actors exploited ChatGPT to develop Windows-based malware, set up command-and-control (C2) infrastructure, and debug multi-language code. The campaign, dubbed ScopeCreep, involved the use of temporary email accounts for one-off ChatGPT sessions, through which the threat actors made small improvements to malware before abandoning the account to avoid detection.
The attackers distributed the AI-enhanced malware through a public repository masquerading as the legitimate gaming utility Crosshair X. Victims who downloaded the trojanized tool had their systems infected by a stealthy loader that retrieved additional payloads, escalated privileges, and exfiltrated sensitive data while evading detection.
The malware used advanced techniques, including PowerShell commands to exclude itself from Windows Defender, timing delays, DLL side-loading, and SOCKS5 proxies to hide its origin. It was designed to steal browser credentials, tokens, and cookies, sending alerts to a Telegram channel controlled by the operators.
In addition to Russian-linked operations, OpenAI also removed accounts tied to Chinese hacking groups APT5 and APT15. The groups utilized ChatGPT to research US satellite technologies, troubleshoot Linux systems, refine scripts, and support infrastructure and app development.
Among others, OpenAI has also detected and disrupted several malicious campaigns:
-
Sneer Review: A China-linked effort to mass-produce geopolitical social media content in English, Chinese, and Urdu.
-
Operation High Five: A Philippines-based network generating politically charged comments for Facebook and TikTok.
-
Operation VAGue Focus: Chinese operatives posing as journalists using ChatGPT for translation and cyberattack research.
-
Operation Helgoland Bite: Russian actors producing content targeting Germany’s 2025 elections and criticizing NATO.
-
Operation Uncle Spam: A China-run operation fueling divisive US political discourse on Bluesky and X.
-
Storm-2035: An Iranian campaign posting pro-Iranian and geopolitical messages under fake identities on X.
-
Operation Wrong Number: A Cambodia-linked task scam network using ChatGPT to create multilingual job scam messages.
