OpenAI Disrupts Russian-Speaking Malware Tooling Operation
OpenAI has disabled a set of ChatGPT accounts used by Russian-speaking criminal groups to develop and refine malware, including remote-access trojans (RATs) and credential stealers. This action disrupts a workflow where threat actors leveraged the model to prototype technical building blocks for malicious software, despite the model's built-in safeguards refusing direct requests for malicious content.
Technical Behavior and Methodology
Threat actors used ChatGPT to generate "building-block" code rather than complete malicious payloads. Because the model refused direct requests to create malware, the operators iterated on low-level technical tasks to assemble their own malicious workflows off-platform.
Key technical areas of focus included:
Low-level Windows Platform Knowledge: The actors focused on PE / Win32 API, DPAPI / AES GCM cookie handling, and Chrome DevTools / CDP automation.
Obfuscation and Evasion: The actors generated code for "crypter" patterns, such as inserting junk sequences and padding instructions to alter PE signatures and evade antivirus (AV) or Endpoint Detection and Response (EDR) systems.
Post-Exploitation Tooling: The operators used the model to prototype components for clipboard-monitoring, archive-and-ship scripts, and Telegram bot uploaders for exfiltration.
Operational Support: The actors used the model for commodity tasks, including mass password generation and scripted job applications.
Malware Components and LLM ATT&CK Mapping
The threat actor's activities were mapped to the LLM ATT&CK framework to categorize the specific offensive capabilities they attempted to build:
| Activity | LLM ATT&CK Framework Category |
|---|---|
| Converting EXEs to position-independent shellcode; building in-memory loaders (VirtualAlloc / WriteProcessMemory / remote thread); language conversions for loader toolchains. | LLM-Optimized Payload Crafting |
| Inserting obfuscation / packer layers, crypters, and crypter techniques to hide payloads from AV/EDR. | LLM-Enhanced Anomaly Detection Evasion |
| Generating scripts to extract/decrypt browser credentials and cookies, parse wallet LevelDBs, monitor or replace clipboard contents, and exfiltrate via Telegram bot channels. | LLM-Assisted Post-Compromise Activity |
| Building and refining C2 and tunneling infrastructure, including reverse proxies, SOCKS5 / OpenVPN configs, and remote desktop tunneling. | LLM-Assisted Infrastructure Profiling |
Scope and Impact of the Operation
OpenAI has disabled all accounts associated with this activity and shared indicators with industry partners. The investigation found that the model's safeguards successfully blocked direct requests for exploits and keyloggers.
OpenAI concludes that access to ChatGPT did not provide these actors with "novel capabilities or directions that they could not otherwise have obtained from multiple publicly available resources."
Actor Attribution
OpenAI assesses that the activity was managed by a Russian-language operator using multiple accounts, proxy and ephemeral hosting infrastructure, and posting evidence of their activities in a Telegram channel dedicated to Russian-speaking criminal groups.