Chinese-language phishing operators used ChatGPT for lures and malware code (UTA0388)
OpenAI banned ChatGPT accounts whose activity overlapped with the groups tracked as UTA0388 by Volexity and UNK_DropPitch by Proofpoint. The operators used the model to write phishing emails in several languages and to debug malware and command-and-control code. Targets included Taiwan's semiconductor sector and US academia and think tanks. Volexity saw the spear phishing campaigns from June 2025, delivering GOVERSHELL malware.
Sources
- Primary: https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf
- Upstream: Editorial
- Entered by the cybermap.lol editors, with sources on the entry
Defenses for this class of incident
all categoriesAn AI-era incident sits in these classes of the AI-security landscape. The companies below work on that class of problem. This is a taxonomy, not a claim that any of them would have changed this incident.
Vendor data: AI Security Startups Map by Prompt Security (CC BY 4.0), synced daily. startups.prompt.security. Paid placements are labelled Sponsored; HeimWall, which runs this site, is labelled Operator. 453 companies in the directory.
Wrong or missing? Email founders@heimwall.ai. Corrections are logged here, in place. How corrections and takedowns work.