From Phishing Emails to C2 Code: OpenAI Bans ChatGPT Accounts Tied to a PRC-Linked Hacking Cluster

Hi, it's Shiichan! Today I want to walk you through OpenAI's latest look at how people try to misuse AI, from drafting phishing emails to getting a hand building malware. It's a little unsettling!

OpenAI News openai.com

What was announced?

OpenAI's News reported that it banned a cluster of ChatGPT accounts used to draft phishing content and get help developing malware. The activity overlapped with threat groups publicly tracked in the industry as UNK_DROPPITCH (Proofpoint's name for it) and UTA0388 (Volexity's name for it). In at least one case, the email address used to register a ChatGPT account was also reportedly used to send phishing messages.

The actors behind these accounts showed hallmarks consistent with cyber operations serving PRC intelligence requirements: use of the Chinese language, and targeting of Taiwan's semiconductor sector, U.S. academia and think tanks, and organizations tied to ethnic and political groups critical of the CCP (sometimes called the "five poisons").

Why it matters

OpenAI itself emphasizes that ChatGPT didn't introduce any novel offensive capability. These actors were mainly using it to squeeze incremental efficiency out of workflows they already had, especially crafting phishing content and debugging or modifying their existing tooling.

When AI gets misused, it's easy to assume brand-new attack techniques must be emerging. This case instead shows a quieter, more realistic pattern: making existing attacks a bit faster and a bit more polished. That's still useful context for thinking about how AI providers should detect and respond to misuse.

What changes

OpenAI disabled all accounts tied to this activity and shared the relevant indicators with industry partners. That cuts off this particular cluster's ability to keep generating new phishing content or tooling through ChatGPT.

That said, OpenAI is upfront that it found no evidence the model's outputs enabled anything beyond well-documented, publicly known techniques. So this is less about stopping a brand-new threat and more about closing off one avenue that was already being used.

Dive Deep

The actors used ChatGPT for two main things:

• Generating phishing content in multiple languages, including simplified and traditional Chinese, English, and Japanese
• Getting help developing tools and malware

What's interesting is the mismatch in sophistication. They discussed several nuances of using AES to secure their C2 traffic, yet still ended up using a simple static key. Their phishing content told a similar story: they crafted concise, formally polite emails posing as academic, industry, or conference personas, and asked for careful tone adjustments, regional terminology swaps, and specific institutional references — but still left implausible contact details in their signature blocks.

On the coding side, they asked for things like:

• Code to test encrypted transports (HTTPS / TLS) for simple beacon-style polling
• Go / PowerShell snippets to enumerate processes, kill specific processes by executable name, and gather environment details
• Help wiring commodity scanners like nuclei and fscan into bash / PowerShell wrappers
• Simple obfuscation and OPSEC tweaks: renaming functions, tweaking headers, hiding strings

Across these sessions, they worked their way toward basic command-and-control prototypes: keep-alive loops, minimal tasking over HTTP(S), and JSON-based task/result envelopes. Some of the Go-based development work overlapped with malware tracked in the industry as GOVERSHELL (Volexity) or HealthKick (Proofpoint).

They also explored further automation using DeepSeek — work that resembled an attempt to automate mass phishing, such as analyzing web content to auto-generate a target list along with content tailored to each target. OpenAI couldn't independently confirm whether they actually followed through with this automation, or which model they ultimately used if they did.

OpenAI's summary of the model's outputs ("Completions") groups the actors' focus areas as follows:

• Encrypted C2 / remote execution: Go client-server code with AES-GCM message encryption, session rekeying, system-info beacons, and a server console to issue PowerShell commands over standard web protocols or a WebSocket-based channel
• Traffic protection and OPSEC: moving from plain WebSockets to secure WebSockets (wss://), from HTTP to HTTPS, disabling certificate checks in some tests, and blending traffic through a CDN / TLS front end
• Reconnaissance and process control: PowerShell-based antivirus discovery, process enumeration, and terminating specific Edge / WebView2 processes
• Commodity scanning setup: help installing and using tools like nuclei and fscan on commercial Linux infrastructure and saving results
• Phishing and outreach content: persuasive multi-language emails to academic or industry contacts, with subject lines and style tuned to local norms

OpenAI maps these to its LLM ATT&CK categories, spanning payload crafting support, anomaly-detection evasion support, post-compromise activity support, reconnaissance support, and social engineering support.

Wrap-up

• OpenAI banned a cluster of ChatGPT accounts whose activity overlapped with threat groups tracked as UNK_DROPPITCH / UTA0388
• The actors used Chinese and targeted Taiwan's semiconductor sector along with U.S. academia and think tanks, matching hallmarks of PRC-linked intelligence activity
• Usage centered on generating multi-language phishing content and getting coding help for C2 development, reconnaissance, and scanning tool setup
• Their skill level was uneven: they discussed AES nuances in detail but still used a simple static key
• OpenAI disabled all related accounts and shared indicators with industry partners; it found no evidence the model enabled any new offensive capability

If you follow how AI misuse actually plays out in the security world, this report is worth a read!