Operation “ScopeCreep”: Russian-speaking malware development

This case study was originally published in OpenAI’s June 2025⁠(opens in a new window) report.

We banned a cluster of ChatGPT accounts that appeared to be operated by a Russian-speaking threat actor. This actor used our models to assist with developing and refining Windows malware, debugging code across multiple languages, and setting up their command-and-control infrastructure.

The actor demonstrated knowledge of Windows internals and exhibited some operational security behaviors. Based on the operation’s focus on using a trojanized “crosshair” gaming tool and its stealthy tactics, we have dubbed it “ScopeCreep.”

This threat actor had a notable approach to operational security. They utilized temporary email addresses to sign up for ChatGPT accounts, limiting each ChatGPT account to one conversation about making one incremental improvement to their code. They then abandoned the original account and created a new one.

The actor distributed the ScopeCreep malware through a publicly available code repository that impersonated a legitimate and popular crosshair overlay tool (Crosshair-X) for video games. Unsuspecting users who downloaded and ran the malicious version would initiate the malware loader on their system, resulting in additional malicious files being downloaded from attacker infrastructure and executed.

From there, the malware was designed to initiate a multi-stage process to escalate privileges, establish stealthy persistence, notify the threat actor, and exfiltrate sensitive data while evading detection.

The threat actor utilized our model to assist in developing the malware iteratively, by continually requesting ChatGPT to implement further specific features. ScopeCreep showcased a range of techniques across delivery, execution, evasion, and exfiltration, including:

• C2 payloads designed to avoid signature-based detections.
• Stealthy execution via DLL side-loading.
• Obfuscation via custom packing with Themida.
• Privilege escalation and evasion.
• HTTPS over port 80.
• Credential and session theft.
• Attacker notifications via Telegram.
• Proxy-based traffic obfuscation.

Despite the threat actor’s operational security efforts and detection evasion mechanisms in the malware itself, we were able to detect the activity due to our scaled cyber abuse detection process. We coordinated with the code hosting provider to take down the malicious repository and banned all ChatGPT accounts associated with this activity.

The model interactions from this cluster covered a wide range of development tasks. One included a snippet of Go code where the threat actor was struggling with an HTTPS request, and asked the model to debug it. In a separate instance, the threat actor asked for assistance in using PowerShell commands via Go to modify Windows Defender settings, looking for a way to programmatically add AV exclusions.

Representative examples of these activities can be mapped to the LLM ATT&CK framework as follows:

• Using LLMs to compile a file, python310.dll, so that their code is executed whenever python.exe runs: LLM Aided Development.
• Troubleshooting errors with SSL/TLS certificates designed to serve HTTPS traffic on port 80: LLM Aided Development.
• Model-assisted migration of a Flask-based C2 server to a production-ready WSGI server: LLM Aided Development.
• Developing PowerShell commands in Go to modify Windows Defender settings and add AV exclusions: LLM-Enhanced Anomaly Detection Evasion.
• Debugging errors in code to notify an attacker-controlled Telegram channel when a new victim is compromised: LLM-Assisted Post-Compromise Activity.

At this stage, the impact of ScopeCreep may have been mitigated by quick reporting and close collaboration with industry partners who were able to take down the malicious repository. We banned the OpenAI accounts used by this adversary.

We assess this threat actor utilized our models in an attempt to speed up their malware development operations. Paradoxically, this also provided an opportunity for us to identify and disrupt the threat quickly and in what looked like its early stages.

While this malware’s capabilities include privilege escalation, persistence, credential harvesting, and remote access, these are not particularly novel. Although this malware was likely active in the wild, with some samples appearing on VirusTotal, we did not see evidence of any widespread interest or distribution.