Silver Lining Playbook: Likely China-origin activity targeting US persons

This case study was originally published in OpenAI’s February 2026⁠(opens in a new window) report on disrupting malicious uses of AI.

We banned a small set of ChatGPT accounts likely originated in China that used our models to request information about US persons, forums and federal building locations, guidance on face- swapping software and generated emails in English that resembled attempts at social engineering. They prompted our models in Chinese language, were mostly active during mainland Chinese business hours and used VPNs to access our platform.

The accounts generated email drafts that purported to be sent from employees of a Hong Kong- based company named “Nimbus Hub Consulting”. However, they prompted our models in Simplified Chinese characters (typically used in mainland China) rather than Traditional Chinese characters (typically used in Hong Kong) suggesting the actual operators were based in mainland China. In addition, one account generated an email purporting to be a representative of a Shanghai-based public relations organization that promotes US-Shanghai economic and cultural exchanges. Based on the company name referencing “Nimbus”, meaning a rain cloud or halo, we named this operation “Silver Lining Playbook”.

The accounts generated English language email drafts that were addressed to state-level US officials or policy analysts working in business and finance. They appeared to invite these recipients to participate in paid consultations, which they described as interpreting policy and providing strategic advice for their clients. They requested the email drafts to be concise, clear, and professional, with subject lines that created urgency and used subtle psychological cues.

In addition, the ChatGPT accounts used our models for general information retrieval, which our model responded to using publicly-available sources. This included queries about the following topics:

• The location of U.S. federal government offices, including main office locations, and a ranked list of states with large concentrations of federal agencies and officials.

• US federal personnel distribution by state.

• US persons, such as Voice of America hosts, including their past interviews and topics of interests.

• Online forums and websites that are commonly used by professionals and job seekers in the US economics and finance industry.

Notably, one account requested guidance on how to install and download on their computer a face-manipulation platform for face-swapping and other media enhancement known as FaceFusion. According to their ChatGPT activity, they described their intention to specifically use its live face‑swap functionality. They asked for step‑by‑step, non‑technical installation guidance and claimed they were novice computer programmers, so the instructions had to be simple. They uploaded a screenshot of their computer’s hardware specifications to assist with the installation. The model responded with information that was drawn from FaceFusion’s publicly-available website and documentation.

Their instructions to generate email drafts using our models reassembled a social-engineering playbook⁠(opens in a new window) for a foreign intelligence service approach, rather than ordinary hiring messages. For each email draft, they requested the following sections:

Establish legitimacy: They presented “Nimbus Hub” as a professional strategic consulting firm with authoritative expertise in geopolitics and transnational policy. They included a link to Nimbus Hub’s website (see screenshot below).

Personalize and flatter the target: They told the model to explicitly cite the recipient’s public- sector background as proof the recipient was the exact fit for the role. In one case, the account uploaded screenshots of the LinkedIn profile of a US person based in Shanghai and instructed the model to personalize the email draft based on text about the individual’s personal experiences and background contained in the screenshots.

Stack incentives: The consulting offer was usually dangled as a lucrative, online opportunity with performance bonuses and referral rewards, while staying vague about the actual work.

Reassuring language and reducing perceived risks: They often claimed the work was relaxing, had timely payments and was confidential.

Move communications off-platform quickly: They always attempted to move the recipients off email and to an initial online video-conference call via WhatsApp, Zoom or Teams.

The networks’ model interactions in this case were not technically sophisticated and their requests sometimes resembled plausible recruitment invitation drafting or legitimate software installation. However, the users’ tactics of hiding behind a fake corporate identity and interests in geopolitical topics indicates a possible intention for adversarial recruitment.

Based on the accounts use of ChatGPT, there was no evidence they successfully elicited responses from their targets to reply to their invitations. We could not independently determine whether the email invitations were actually sent or if any of the targeted recipients responded.

Multiple democratic governments (e.g. USA⁠(opens in a new window), UK⁠(opens in a new window), Australia⁠(opens in a new window)) have warned that foreign intelligence services are targeting current and former government employees for recruitment by posing as consulting firms and other entities on social and professional networking platforms. It may be confusing to distinguish ordinary hiring messages from these targeted social-engineering approaches because they share some similar traits. However, legitimate outreaches are usually optimized for slower screening processes and have verifiable information about the role title, credible employer details, reasonable market compensation ranges and links to real job postings. In short, if it’s too good to be true, then it probably is.