APT Hackers Abuse ChatGPT to Develop Advanced Malware and Phishing Campaigns

Security researchers at Volexity have uncovered that China-aligned threat actors, tracked as UTA0388, have been using AI platforms such as ChatGPT to bolster their spear-phishing and malware development campaigns since June 2025. The group has crafted multilingual phishing emails targeting organisations across North America, Asia and Europe, with more than 50 unique messages observed in English, Chinese, Japanese, French and German, though the emails often lacked coherence.

GOVERSHELL is the name given to five distinct malware variants associated with UTA0388, each representing substantial rewrites and new network stacks, including diverse command-and-control methods from fake TLS communications to WebSocket connections. Persistence is achieved via scheduled tasks and by loading malicious DLLs alongside legitimate executables, with artefacts pointing to Simplified Chinese in developer paths and python-docx usage in metadata.

According to OpenAI, the platform was leveraged for spear phishing and malware development operations, with indicators such as fabricated organisational details and unusual archive Easter eggs, and targeted emails drawn from fake addresses scraped from websites. 9 October 2025.