Hackers using generative AI “ChatGPT” to evade anti-virus defenses

According to GBHackers, hackers are using generative AI, specifically ChatGPT, to create deepfake IDs and accompany spear-phishing lures that evade anti-virus scanning. In July 2025, the Genians Security Center (GSC) identified a campaign attributed to North Korea’s Kimsuky group that impersonated a defence-related institution and delivered batch files and AutoIt scripts designed to bypass antivirus protections through obfuscation.

Attackers generated sample military ID card images with ChatGPT and embedded these deepfakes in a lure disguised as an ID issuance review request, with a .lnk shortcut launching a PowerShell command after a seven-second delay to avoid sandbox timeouts. The scripts then downloaded a malicious batch file and an image from a private C2 server, with the image metadata indicating ChatGPT as the origin.

The defence and recommendations call for robust endpoint security with EDR platforms to unmask hidden scripts, flag behavior-based anomalies, and visualise full attack chains, as obfuscation and AI-generated decoys are accelerating state-sponsored threat capabilities, according to the article.