Cyber Operation: Korean-language malware support

This case study was originally published in OpenAI’s October 2025⁠(opens in a new window) report.

We identified and banned a cluster of ChatGPT accounts whose Korean-language operators attempted to use our models to engage in malware and command-and-control (C2) development. Indicators that we observed in our casework overlap with a Trellix report that tied similar activity to spear phishing campaigns against South Korean diplomatic missions, the deployment of XenoRAT malware, and the use of GitHub-based repositories for C2.

While the overlap with Trellix reporting, including the observed use of Korean language, activity consistent with the UTC+8 and UTC+9 time zones, and operational themes and topics, is consistent with the security community’s understanding of North Korean (DPRK) actors, we are not able to independently make an attribution, and we also block access to our services from North Korea.

The accounts engaged with our models primarily in the Korean language, showing structured workflows with many accounts active in narrow time windows. Each of these accounts appears to have focused on a specific use case, for example converting Chrome extensions to Safari for Apple App Store publication, configuring Windows Server VPNs, or developing macOS Finder extensions, rather than each account spanning multiple technical areas.

We observed interactions with our models such as Windows API hooking, browser credential and cookie access workflows (DPAPI), and look-alike verification pages such as reCAPTCHA clones. We also saw draft phishing emails in Korean, often themed around cryptocurrency and designed to look like messages from government or financial service providers.

In addition, the actors experimented with cloud-storage services such as pCloud, file.io, GDrive direct-link construction and API scripting, and GitHub functions such as raw content retrieval and token handling. We did not find evidence that malicious binaries used in the campaigns described by Trellix were generated with our models. It is possible that the same operators were using our models while staging payloads through developer and cloud platforms.

The threat actors generated model outputs that were designed to support multiple operational areas, including:

• Implant and RAT-adjacent development: exploration around reflective DLL loading, in-memory execution, and Windows API hooking techniques.
• Credential theft routines: generating, modifying, and debugging scripts to extract browser encryption keys, cookies, and saved passwords using Chrome / Edge DPAPI workflows.
• Phishing and lures: drafting what appeared to be Korean-language phishing content, often themed around cryptocurrency, government institutions, or financial service providers; experimenting with HTML obfuscation and proxying reCAPTCHA for convincing login pages.
• macOS development scaffolding: requests around Finder and Safari extension development and the generation of a sample App Store privacy policy.
• Cryptocurrency operations: troubleshooting API calls and wallet interactions.

Many of these requests fell into the gray zone of dual-use activity. These can involve entirely legitimate applications such as software debugging, cryptography, or browser development, but take on a different significance when repurposed by a threat actor.

We disabled all accounts associated with this operation and shared relevant indicators with partners. We found no evidence that model access enabled novel capabilities beyond what is already publicly available.