#### [Research](/security/research/)**5** ChatGPT used for evil: Fake IT worker resumes, misinfo, and cyber-op assist===========================================================================**5** OpenAI boots accounts linked to 10 malicious campaigns——————————————————[Jessica Lyons](/Author/Jessica-Lyons ‘Read more by this author’) Fri 6 Jun 2025 // 19:56 UTC [](https://www.reddit.com/submit?url=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=ChatGPT%20used%20for%20evil%3a%20Fake%20IT%20worker%20resumes%2c%20misinfo%2c%20and%20cyber-op%20assist) [](https://twitter.com/intent/tweet?text=ChatGPT%20used%20for%20evil%3a%20Fake%20IT%20worker%20resumes%2c%20misinfo%2c%20and%20cyber-op%20assist&url=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=ChatGPT%20used%20for%20evil%3a%20Fake%20IT%20worker%20resumes%2c%20misinfo%2c%20and%20cyber-op%20assist&summary=OpenAI%20boots%20accounts%20linked%20to%2010%20malicious%20campaigns) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) Fake IT workers possibly linked to North Korea, Beijing-backed cyber operatives, and Russian malware slingers are among the baddies using ChatGPT for evil, according to OpenAI’s latest threat report.The AI giant said it quashed 10 operations using its chatbot to conduct social engineering and cyber snooping campaigns, generate spammy social media content, and even develop a multi-stage malware campaign targeting people and organizations around the globe. Four of the 10 campaigns were likely of Chinese origin, and OpenAI banned all of the ChatGPT accounts associated with the malicious activities.These included accounts linked to ‘multiple’ [fake IT worker campaigns](https://www.theregister.com/2025/04/29/north_korea_worker_interview_questions/), which used the language models to craft application materials for software engineering and other remote jobs. ’While we cannot determine the locations or nationalities of the threat actors, their behaviors were consistent with activity publicly attributed to IT worker schemes connected to North Korea (DPRK),’ the report said -[[PDF](https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf)-]. ‘Some of the actors linked to these recent campaigns may have been employed as contractors by the core group of potential DPRK-linked threat actors to perform application tasks and operate hardware, including within the US.’  In addition to using AI to create fake, US-based personas with fabricated employment histories (as has been previously [documented by OpenAI](https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf) and other researchers), some of the newer campaigns attempted to auto-generate resumes.Plus, OpenAI detected indicators of operators in Africa posing as job applicants along with recruiting people in North America to run laptop farms — along the lines of [an Arizona woman](https://www.theregister.com/2025/02/12/arizona_woman_laptop_farm_guilty/) who was busted for her role in raking in millions for North Korea while allegedly scamming more than 300 US companies.### Russian trolls, malware devsOther banned accounts originated from Russia, and the AI company’s threat hunters caught them doing the [usual election trolling](https://www.theregister.com/2024/10/25/russia_china_iran_election_disinfo/), in this case, using the chatbot to generate German-language content about the country’s 2025 election. The spammers used a Telegram channel with 1,755 subscribers and an X account with more than 27,000 followers to distribute their content, in one instance xeeting: ‘We urgently need a ‘DOGE ministry’ when the AfD finally takes office,’ referring to the Alternative für Deutschland (AfD) party.The Telegram channel regularly reported fake news stories and commentary lifted straight from a website that the French government linked to a Russian propaganda network called ‘[Portal Kombat](https://www.diplomatie.gouv.fr/en/french-foreign-policy/security-disarmament-and-non-proliferation/news/2024/article/foreign-digital-interference-result-of-investigations-into-the-russian).’ In one of the more interesting operations: OpenAI banned a cluster of accounts operated by a Russian-speaking individual using ChatGPT to develop Windows malware dubbed ScopeCreep and set up command-and-control infrastructure: This threat actor had a notable approach to operational security. They utilized temporary email addresses to sign up for ChatGPT accounts, limiting each ChatGPT account to one conversation about making one incremental improvement to their code. They then abandoned the original account and created a new one.The criminal then distributed the ScopeCreep malware via a publicly available code repository that spoofed a legitimate crosshair overlay tool (Crosshair X) for video games.The malware itself, developed by continually prompting ChatGPT to implement specific features, included a number of notable capabilities. It’s written in Go, and uses a number of tricks to avoid being detected by anti-virus and other malware-stopping tools.* [OpenAI says Chinese gang tried to phish its staff](https://www.theregister.com/2024/10/10/china_phish_openai/)* [How nice that state-of-the-art LLMs reveal their reasoning … for miscreants to exploit](https://www.theregister.com/2025/02/25/chain_of_thought_jailbreaking/)* [OpenAI kills Iranian accounts using ChatGPT to write US election disinfo](https://www.theregister.com/2024/08/19/openai_iranian_accounts/)* [OpenAI to pull plug on ‘unsupported’ nations — cough, China — from July 9](https://www.theregister.com/2024/06/25/openai_unsupported_countries/)After the unsuspecting gamer runs the malware, it’s designed to escalate privileges, harvest browser-stored credentials, tokens, and cookies, and exfiltrate them to attacker-controlled infrastructure.Despite their successful efforts in using the LLM to help develop malware, the info-stealing campaign itself didn’t get very far, we’re told. ‘Although this malware was likely active in the wild, with some samples appearing on VirusTotal, we did not see evidence of any widespread interest or distribution,’ OpenAI wrote.### Chinese APTs abusing ChatGPTPerhaps unsurprisingly, nearly half of the malicious operations likely originated in China.The bulk of these used the AI models to generate a ton of social media posts and profile images across TikTok, X, Bluesky, Reddit, Facebook, and other websites. The content, written primarily in English and Chinese, with a focus on Taiwan, American tariffs and politics, and pro-Chinese Communist Party narratives, according to the report.This time around, however, [Chinese government-backed operators](https://www.theregister.com/2025/04/29/fbi_china_ai/) used ChatGPT to support open-source research, script tweaking, system troubleshooting, and software development. OpenAI noted that while this activity aligned with known APT infrastructure, the models didn’t provide capabilities beyond what’s available through public resources.All of these now-banned accounts were associated with ‘multiple’ unnamed PRC-backed hackers, and used infrastructure operated by [Keyhole Panda](https://attack.mitre.org/groups/G1023/) (aka APT5) and [Vixen Panda](https://attack.mitre.org/groups/G0004/) (aka APT15).In some of the more technical queries, the prompts ‘included mention of reNgine, an automated reconnaissance framework for web applications, and Selenium automation, designed to bypass login mechanisms and capture authorization tokens,’ the research noted.The ChatGPT interactions related to software development ‘included web and Android app development, and both C-language and Golang software. Infrastructure setup included configuring VPNs, software installation, Docker container deployments, and local LLM deployments such as DeepSeek.’ ® [Sponsored: Making work work better: TeamViewer and the future of the digital workplace](https://go.theregister.com/tl/3196/shttps://www.theregister.com/2025/06/02/teamviewer_digital_workplace_tensor_dex_remote/) Share [](https://www.reddit.com/submit?url=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=ChatGPT%20used%20for%20evil%3a%20Fake%20IT%20worker%20resumes%2c%20misinfo%2c%20and%20cyber-op%20assist) [](https://twitter.com/intent/tweet?text=ChatGPT%20used%20for%20evil%3a%20Fake%20IT%20worker%20resumes%2c%20misinfo%2c%20and%20cyber-op%20assist&url=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=ChatGPT%20used%20for%20evil%3a%20Fake%20IT%20worker%20resumes%2c%20misinfo%2c%20and%20cyber-op%20assist&summary=OpenAI%20boots%20accounts%20linked%20to%2010%20malicious%20campaigns) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) #### More about* [AI](/Tag/AI/)* [ChatGPT](/Tag/ChatGPT/)* [China](/Tag/China/) More like these × ### More about* [AI](/Tag/AI/)* [ChatGPT](/Tag/ChatGPT/)* [China](/Tag/China/)* [Cybercrime](/Tag/Cybercrime/)* [Security](/Tag/Security/) ### Narrower topics* [2FA](/Tag/2FA/)* [Advanced persistent threat](/Tag/Advanced%20persistent%20threat/)* [AIOps](/Tag/AIOps/)* [Application Delivery Controller](/Tag/Application%20Delivery%20Controller/)* [Authentication](/Tag/Authentication/)* [BEC](/Tag/BEC/)* [Black Hat](/Tag/Black%20Hat/)* [BSides](/Tag/BSides/)* [Bug Bounty](/Tag/Bug%20Bounty/)* [CHERI](/Tag/CHERI/)* [China Mobile](/Tag/China%20Mobile/)* [China telecom](/Tag/China%20telecom/)* [China Unicom](/Tag/China%20Unicom/)* [CISO](/Tag/CISO/)* [Common Vulnerability Scoring System](/Tag/Common%20Vulnerability%20Scoring%20System/)* [Cybersecurity](/Tag/Cybersecurity/)* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Cybersecurity Information Sharing Act](/Tag/Cybersecurity%20Information%20Sharing%20Act/)* [Cyberspace Administration of China](/Tag/Cyberspace%20Administration%20of%20China/)* [Data Breach](/Tag/Data%20Breach/)* [Data Protection](/Tag/Data%20Protection/)* [Data Theft](/Tag/Data%20Theft/)* [DDoS](/Tag/DDoS/)* [DeepSeek](/Tag/DeepSeek/)* [DEF CON](/Tag/DEF%20CON/)* [Digital certificate](/Tag/Digital%20certificate/)* [Encryption](/Tag/Encryption/)* [Exploit](/Tag/Exploit/)* [Firewall](/Tag/Firewall/)* [Gemini](/Tag/Gemini/)* [Google AI](/Tag/Google%20AI/)* [GPT-3](/Tag/GPT-3/)* [GPT-4](/Tag/GPT-4/)* [Great Firewall](/Tag/Great%20Firewall/)* [Hacker](/Tag/Hacker/)* [Hacking](/Tag/Hacking/)* [Hacktivism](/Tag/Hacktivism/)* [Hong Kong](/Tag/Hong%20Kong/)* [Identity Theft](/Tag/Identity%20Theft/)* [Incident response](/Tag/Incident%20response/)* [Information Technology and the People’s Republic of China](/Tag/Information%20Technology%20and%20the%20People%27s%20Republic%20of%20China/)* [Infosec](/Tag/Infosec/)* [Infrastructure Security](/Tag/Infrastructure%20Security/)* [JD.com](/Tag/JD.com/)* [Kenna Security](/Tag/Kenna%20Security/)* [Machine Learning](/Tag/Machine%20Learning/)* [MCubed](/Tag/MCubed/)* [NCSAM](/Tag/NCSAM/)* [NCSC](/Tag/NCSC/)* [Neural Networks](/Tag/Neural%20Networks/)* [NLP](/Tag/NLP/)* [Palo Alto Networks](/Tag/Palo%20Alto%20Networks/)* [Password](/Tag/Password/)* [Personally Identifiable Information](/Tag/Personally%20Identifiable%20Information/)* [Phishing](/Tag/Phishing/)* [Quantum key distribution](/Tag/Quantum%20key%20distribution/)* [Ransomware](/Tag/Ransomware/)* [Remote Access Trojan](/Tag/Remote%20Access%20Trojan/)* [REvil](/Tag/REvil/)* [RSA Conference](/Tag/RSA%20Conference/)* [Semiconductor Manufacturing International Corporation](/Tag/Semiconductor%20Manufacturing%20International%20Corporation/)* [Shenzhen](/Tag/Shenzhen/)* [Spamming](/Tag/Spamming/)* [Spyware](/Tag/Spyware/)* [Star Wars](/Tag/Star%20Wars/)* [Surveillance](/Tag/Surveillance/)* [Tensor Processing Unit](/Tag/Tensor%20Processing%20Unit/)* [TLS](/Tag/TLS/)* [TOPS](/Tag/TOPS/)* [Trojan](/Tag/Trojan/)* [Trusted Platform Module](/Tag/Trusted%20Platform%20Module/)* [Uyghur Muslims](/Tag/Uyghur%20Muslims/)* [Vulnerability](/Tag/Vulnerability/)* [Wannacry](/Tag/Wannacry/)* [Zero trust](/Tag/Zero%20trust/) ### Broader topics* [APAC](/Tag/APAC/)* [Large Language Model](/Tag/Large%20Language%20Model/)* [OpenAI](/Tag/OpenAI/)* [Self-driving Car](/Tag/Self-driving%20Car/) #### More aboutShare [](https://www.reddit.com/submit?url=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=ChatGPT%20used%20for%20evil%3a%20Fake%20IT%20worker%20resumes%2c%20misinfo%2c%20and%20cyber-op%20assist) [](https://twitter.com/intent/tweet?text=ChatGPT%20used%20for%20evil%3a%20Fake%20IT%20worker%20resumes%2c%20misinfo%2c%20and%20cyber-op%20assist&url=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=ChatGPT%20used%20for%20evil%3a%20Fake%20IT%20worker%20resumes%2c%20misinfo%2c%20and%20cyber-op%20assist&summary=OpenAI%20boots%20accounts%20linked%20to%2010%20malicious%20campaigns) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2025/06/06/chatgpt_for_evil/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) **5** COMMENTS #### More about* [AI](/Tag/AI/)* [ChatGPT](/Tag/ChatGPT/)* [China](/Tag/China/) More like these × ### More about* [AI](/Tag/AI/)* [ChatGPT](/Tag/ChatGPT/)* [China](/Tag/China/)* [Cybercrime](/Tag/Cybercrime/)* [Security](/Tag/Security/) ### Narrower topics* [2FA](/Tag/2FA/)* [Advanced persistent threat](/Tag/Advanced%20persistent%20threat/)* [AIOps](/Tag/AIOps/)* [Application Delivery Controller](/Tag/Application%20Delivery%20Controller/)* [Authentication](/Tag/Authentication/)* [BEC](/Tag/BEC/)* [Black Hat](/Tag/Black%20Hat/)* [BSides](/Tag/BSides/)* [Bug Bounty](/Tag/Bug%20Bounty/)* [CHERI](/Tag/CHERI/)* [China Mobile](/Tag/China%20Mobile/)* [China telecom](/Tag/China%20telecom/)* [China Unicom](/Tag/China%20Unicom/)* [CISO](/Tag/CISO/)* [Common Vulnerability Scoring System](/Tag/Common%20Vulnerability%20Scoring%20System/)* [Cybersecurity](/Tag/Cybersecurity/)* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Cybersecurity Information Sharing Act](/Tag/Cybersecurity%20Information%20Sharing%20Act/)* [Cyberspace Administration of China](/Tag/Cyberspace%20Administration%20of%20China/)* [Data Breach](/Tag/Data%20Breach/)* [Data Protection](/Tag/Data%20Protection/)* [Data Theft](/Tag/Data%20Theft/)* [DDoS](/Tag/DDoS/)* [DeepSeek](/Tag/DeepSeek/)* [DEF CON](/Tag/DEF%20CON/)* [Digital certificate](/Tag/Digital%20certificate/)* [Encryption](/Tag/Encryption/)* [Exploit](/Tag/Exploit/)* [Firewall](/Tag/Firewall/)* [Gemini](/Tag/Gemini/)* [Google AI](/Tag/Google%20AI/)* [GPT-3](/Tag/GPT-3/)* [GPT-4](/Tag/GPT-4/)* [Great Firewall](/Tag/Great%20Firewall/)* [Hacker](/Tag/Hacker/)* [Hacking](/Tag/Hacking/)* [Hacktivism](/Tag/Hacktivism/)* [Hong Kong](/Tag/Hong%20Kong/)* [Identity Theft](/Tag/Identity%20Theft/)* [Incident response](/Tag/Incident%20response/)* [Information Technology and the People’s Republic of China](/Tag/Information%20Technology%20and%20the%20People%27s%20Republic%20of%20China/)* [Infosec](/Tag/Infosec/)* [Infrastructure Security](/Tag/Infrastructure%20Security/)* [JD.com](/Tag/JD.com/)* [Kenna Security](/Tag/Kenna%20Security/)* [Machine Learning](/Tag/Machine%20Learning/)* [MCubed](/Tag/MCubed/)* [NCSAM](/Tag/NCSAM/)* [NCSC](/Tag/NCSC/)* [Neural Networks](/Tag/Neural%20Networks/)* [NLP](/Tag/NLP/)* [Palo Alto Networks](/Tag/Palo%20Alto%20Networks/)* [Password](/Tag/Password/)* [Personally Identifiable Information](/Tag/Personally%20Identifiable%20Information/)* [Phishing](/Tag/Phishing/)* [Quantum key distribution](/Tag/Quantum%20key%20distribution/)* [Ransomware](/Tag/Ransomware/)* [Remote Access Trojan](/Tag/Remote%20Access%20Trojan/)* [REvil](/Tag/REvil/)* [RSA Conference](/Tag/RSA%20Conference/)* [Semiconductor Manufacturing International Corporation](/Tag/Semiconductor%20Manufacturing%20International%20Corporation/)* [Shenzhen](/Tag/Shenzhen/)* [Spamming](/Tag/Spamming/)* [Spyware](/Tag/Spyware/)* [Star Wars](/Tag/Star%20Wars/)* [Surveillance](/Tag/Surveillance/)* [Tensor Processing Unit](/Tag/Tensor%20Processing%20Unit/)* [TLS](/Tag/TLS/)* [TOPS](/Tag/TOPS/)* [Trojan](/Tag/Trojan/)* [Trusted Platform Module](/Tag/Trusted%20Platform%20Module/)* [Uyghur Muslims](/Tag/Uyghur%20Muslims/)* [Vulnerability](/Tag/Vulnerability/)* [Wannacry](/Tag/Wannacry/)* [Zero trust](/Tag/Zero%20trust/) ### Broader topics* [APAC](/Tag/APAC/)* [Large Language Model](/Tag/Large%20Language%20Model/)* [OpenAI](/Tag/OpenAI/)* [Self-driving Car](/Tag/Self-driving%20Car/) #### TIP US OFF[Send us news](https://www.theregister.com/Profile/contact/)[#### Crims defeat human intelligence with fake AI installers they poison with ransomwareTake care when downloading AI freebies, researcher tells *The Register*Cyber-crime8 days -| 7](/2025/05/30/fake_ai_installers_carry_ransomware/?td=keepreading) [#### Don’t click on that Facebook ad for a text-to-AI-video toolMillions may fall for it – and end up with malware insteadCyber-crime10 days -| 7](/2025/05/27/fake_social_media_ads_ai_tool/?td=keepreading) [#### Here’s what it’ll take for Nvidia and other US chipmakers to flog AI chips in ChinaJensen be limbo, Jensen be quick, Jensen go under the Uncle Sam’s limbo stickSystems10 days -| 11](/2025/05/28/nvidia_us_chipmakers_ai_requirements_china/?td=keepreading) [#### Why rapid proliferation of cloud native apps requires faster, more efficient toolsetsKubernetes enables easy, rapid AI app development, making it the industry standard for AI workloadsSponsored feature](/2025/05/13/nutanix_cloud_native_ai_apps/?td=keepreading) [#### Are you a big AI business vendor making terrible AI business decisions? We can helpOpinion The word Microsoft does not appear in this article. Why would you think otherwise?AI + ML5 days -| 10](/2025/06/02/opinion_ai/?td=keepreading) [#### Schneier tries to rip the rose-colored AI glasses from the eyes of CongressDOGE moves fast and breaks things, and now our data is at risk, security guru warns in hearingPublic Sector10 hrs -| 21](/2025/06/06/schneier_doge_risks/?td=keepreading) [#### Dem senators pen stern letter urging Noem to reinstate cyber review boardRemember Salt Typhoon? Anyone?Public Sector5 days -| 8](/2025/06/02/senators_to_noem_reestablish_csrb/?td=keepreading) [#### Ivanti makes dedicated fans of Chinese spies who just can’t resist attacking its buggy kitIf it ain’t broke?Datacenter Networking Nexus15 days -| 1](/2025/05/23/ivanti_chinese_spies_attack/?td=keepreading) [#### Google co-founder Sergey Brin suggests threatening AI for better resultsSo much for buttering up ChatGPT with ‘Please’ and ‘Thank you’AI + ML10 days -| 60](/2025/05/28/google_brin_suggests_threatening_ai/?td=keepreading) [#### ASUS to chase business PC market with free AI, or no AI – because nobody knows what to do with itComputex Really strong USB ports make a difference too by reducing the need for motherboard replacementsPersonal Tech10 days -| 22](/2025/05/28/asus_business_pc_plans/?td=keepreading) [#### AI kept 15-year-old zombie vuln alive, but its time is drawing nearResearchers have come up with a fix for a path traversal bug first spotted in 2010Research2 days -| 26](/2025/06/05/llm_kept_persistent_path_traversal_bug_alive/?td=keepreading) [#### Trump trade policy to cost Nvidia $10.5B in lost H20 GPU revenuesBut don’t worry, sales are still up 69 percentSystems9 days -| 1](/2025/05/29/nvidia_q1_fy_2026/?td=keepreading)
Related Tags:
Mulberry Typhoon
UNC2630
APT5
MANGANESE
BRONZE FLEETWOOD
Salt Typhoon
Nylon Typhoon
NAICS: 54 – Professional
Scientific
Technical Services
NAICS: 541 – Professional
Scientific
Technical Services
Associated Indicators: