OpenAI Disrupts Russian, North Korean, and Chinese Hackers Misusing ChatGPT for Cyberattacks

OpenAI said it disrupted three activity clusters exploiting its ChatGPT tool to assist malware development, including a Russian-language threat actor that used the chatbot to help develop and refine a remote access trojan and a credential stealer, also using several ChatGPT accounts to prototype post‑exploitation components.

According to OpenAI, while the large language models refused direct requests for malicious content, the threat actor composed building‑block code that was assembled into workflows, with outputs that included obfuscation, clipboard monitoring and data exfiltration capabilities via a Telegram bot.

A second cluster originated in North Korea and overlapped with a Trellix‑detailed August 2025 campaign targeting diplomatic missions in South Korea using spear‑phishing to deliver Xeno RAT, with OpenAI noting development of malware and C2 workflows, macOS Finder extensions and Windows infrastructure tooling.

The third cluster, linked to a Chinese group tracked as UNK_DropPitch (aka UTA0388), used ChatGPT to draft phishing emails and assist with tooling for remote execution and other tasks, with outputs described as technically competent but unsophisticated. OpenAI reiterated that its tools provided these threat actors with capabilities they could not easily obtain from public sources, enabling incremental workflow efficiency.