Tag: chatgpt

7 Attack Reports | 0 Vulnerabilities

Attack reports

AI-Poisoning & AMOS Stealer: How Trust Became the Biggest Mac Threat

A sophisticated malware campaign exploits user trust in AI platforms to deliver the AMOS stealer. Attackers use SEO poisoning to surface malicious ChatGPT and Grok conversations offering 'helpful' macOS disk cleanup advice. These conversations contain Terminal commands that, when executed, deploy A…

social engineering

credential harvesting

atomic macos stealer

seo manipulation

Published: December 10, 2025

Downloadable IOCs: 8

Leveraging Generative AI to Reverse Engineer XLoader

This report details how generative AI was used to accelerate the reverse engineering of XLoader malware. The researchers employed a combination of cloud-based static analysis using exported IDA data and occasional dynamic checks via MCP to rapidly unpack encrypted code, deobfuscate API calls, and d…

malware analysis

reverse engineering

Published: November 3, 2025

Downloadable IOCs: 16

AI-Driven Deepfake Military ID Fraud Campaign

The Kimsuky APT group has launched a sophisticated spear-phishing campaign using AI-generated deepfake military ID cards to target South Korean defense institutions. The attack impersonates military employee ID issuance processes and exploits ChatGPT to create convincing fake ID images. The malware…

Published: September 15, 2025

Downloadable IOCs: 21

Dissecting PipeMagic: Inside the architecture of a modular backdoor framework

PipeMagic is a sophisticated modular backdoor used by the Storm-2460 threat actor, disguised as a legitimate ChatGPT Desktop Application. It employs a highly flexible architecture with multiple linked list structures for payload management, execution, and networking. The malware communicates with i…

Published: August 18, 2025

Linked vulnerabilities : CVE-2025-29824 (CVSS 7.8)

Downloadable IOCs: 4

Inside a Malware Campaign: A Nigerian Hacker's Perspective

This analysis provides an in-depth look at a Nigerian cybercriminal's malware campaign process. The hacker begins by harvesting email addresses through Google dorking techniques, targeting specific industries and regions. They then configure email campaigns using spoofed domains and bulletproof hos…

social engineering

redline stealer

nigerian hacker

gammadyne mailer

email harvesting

Published: February 14, 2025

Downloadable IOCs: 2

Threat actors use ChatGPT to write malware

OpenAI has disrupted over 20 malicious cyber operations abusing ChatGPT for various purposes, including malware development and spear-phishing attacks. The company confirmed cases involving Chinese and Iranian threat actors. SweetSpecter, a Chinese group, targeted OpenAI employees with phishing ema…

social engineering

cyber operations

Published: October 14, 2024

Downloadable IOCs: 1

Disrupting a covert Iranian influence operation

OpenAI is committed to preventing abuse and improving transparency around AI-generated content. This includes our work to detect and stop covert influence operations (IO), which try to manipulate public opinion or influence political outcomes while hiding the true identity or intentions of the acto…

ai-generated content

Published: August 16, 2024

Downloadable IOCs: 5

Click here to see more Attack Reports