Cyber Operation: Russian-speaking malware tooling

This case study was originally published in OpenAI’s October 2025⁠(opens in a new window) report.

We banned ChatGPT accounts that were attempting to use the model to help develop and refine malware, including a remote-access trojan, credential stealers, and features to evade detection. These accounts appear to be affiliated with Russian-speaking criminal groups, as we observed them posting evidence of their activities in a Telegram channel dedicated to those actors. Based on our investigation, we assess that this activity was connected to a Russian-language operator managing multiple accounts and leveraging proxy and ephemeral hosting infrastructure.

This threat actor used multiple ChatGPT accounts primarily to prototype and troubleshoot technical components that enable post-exploitation and credential theft, well known activities for this type of threat actor. The model refused direct requests to generate malicious content, so typical operator use of the model involved eliciting building-block code, such as converting compiled executables into shellcode, designing in-memory loaders, or parsing browser credentials, which the threat actor then likely assembled into malicious workflows.

The threat actor also used our models to generate code for obfuscation and “crypter” patterns, such as inserting padding instructions and junk sequences, clipboard-monitoring, and simple exfiltration helpers, such as a Telegram bot uploader and archive-and-ship scripts. These outputs are not inherently malicious, unless used in such a way by a threat actor outside of our platform.

The threat actor used ChatGPT for predominantly technical tasks such as low-level PE / Win32 API and DPAPI / AES GCM cookie handling, and Chrome DevTools / CDP automation. The threat actor made a mix of high- and lower-sophistication requests: many prompts required deep Windows-platform knowledge and iterative debugging, while others automated commodity tasks such as mass password generation and scripted job applications. The operator used a small number of ChatGPT accounts and iterated on the same code across conversations, a pattern consistent with ongoing development rather than occasional testing.

Our models were not used to execute any threat actor tooling and workflows and we are not able to independently verify any off-platform activity. This threat actor attempted to use our models for developing and refining offensive tooling and operational workflows that appear to enable the stealing of credentials and crypto assets, executing code stealthily, and managing covert infrastructure.

Specifically, they used ChatGPT to generate and iterate on working code and deployment guidance for in-memory execution and shellcode loaders; UAC / SmartScreen / Mark-of-the-Web bypasses; browser credential / cookie extraction and app-bound decryption scaffolds; LevelDB wallet parsing and clipboard-hijack / clipboard-replacement tooling with exfiltration; and remote-access (RAT) components including video and input emulation. In line with their safeguards, our models refused requests that were clearly malicious and lacked any legitimate application.

Representative examples of these activities can be mapped to the LLM ATT&CK framework as follows:

We disabled all accounts associated with this activity and shared relevant indicators with industry partners. We found no evidence that access to our models provided these actors with novel capabilities or directions that they could not otherwise have obtained from multiple publicly available resources. Our models refused direct exploit and keylogger requests.