APT Meets GPT: China-Aligned UTA0388 Used ChatGPT for Automated, Multilingual Spear-Phishing

Volexity has uncovered a China-aligned operation, tracked as UTA0388, that weaponised ChatGPT to automate multilingual spear-phishing and assist in malware development. Starting in June 2025, the group conducted campaigns targeting customers and users across North America, Asia and Europe, impersonating researchers and policy analysts from fake institutions.

Over time, GOVERSHELL, a backdoor deployed via search order hijacking, evolved through five variants written in C++ or Go, with different C2 methods and even jittered timing in later versions. The attackers used AI-generated content to craft emails fluent in English, Chinese, Japanese, French and German, though the output contained nonsensical inconsistencies that revealed AI assistance.

OpenAI’s October 2025 report confirms that UTA0388 leveraged ChatGPT for several components of their phishing and malware operations, and Volexity notes that 26 emails were sent in just three days during the campaigns. The infrastructure included Netlify and Sync in early operations, later moving to self-registered domains such as cdn-apple[.]info, azure-app[.]store and twmoc[.]info, with the campaigns ultimately delivering GOVERSHELL payloads.