OpenAI Report: Chinese and Iranian Hackers Use ChatGPT for Malware and Phishing
Chinese and Iranian hackers use ChatGPT and LLM tools to develop malware and phishing attacks: OpenAI report documents over 20 cyberattacks using ChatGPT
If there is one sign that AI causes more trouble than it is worth, it is OpenAI confirms that there have been more than twenty cyberattacks, all created through ChatGPT. The report confirms that generative AI was used to carry out phishing attacks, debug and develop malware, and perform other malicious activities.
El informe confirma dos ciberataques utilizando la IA generativa ChatGPT. Cisco Talos informó el primero en noviembre de 2024, que fue utilizado por actores de amenazas chinos que apuntaban a gobiernos asiáticos. Este ataque utilizó un método de phishing llamado ‘SweetSpecter', que incluye un archivo ZIP con un archivo malicioso que, si se descarga y se abre, crearía una cadena de infección en el sistema del usuario. OpenAI descubrió que SweetSpecter se creó utilizando varias cuentas que usaban ChatGPT para desarrollar scripts y descubrir vulnerabilidades utilizando una herramienta LLM.
El segundo ciberataque mejorado con IA provino de un grupo con sede en Irán llamado ‘CyberAv3ngers' que utilizó ChatGPT para explotar vulnerabilidades y robar contraseñas de usuarios de PC basadas en macOS. El tercer ataque, liderado por otro grupo con sede en Irán llamado Storm-0817, utilizó ChatGPT para desarrollar malware para AndroidThe malware stole contact lists, extracted call logs and phone history. browser, obtained the precise location of the device and accessed files on the infected devices.
All of these attacks used existing methods to develop malware y, según el informe, no ha habido indicios de que ChatGPT haya creado malware sustancialmente nuevo. De todos modos, muestra lo fácil que es para los actores de amenazas engañar a los servicios de IA generativa para que creen herramientas de ataque maliciosas. Abre una nueva lata de gusanos, demostrando que es más fácil para cualquier persona con el conocimiento necesario activar ChatGPT para hacer algo con malas intenciones. Si bien hay investigadores de security discovering such potential vulnerabilities to report and patch them, attacks like this would create the need to discuss the implementation limitations of generative AI.
From now on, OpenAI is firmly committed to continuing to improve its artificial intelligence with the aim of preventing the use of methods that could compromise the security and integrity of its systems. This decision underlines the importance of maintaining a proactive approach to protecting its technologies In the meantime, OpenAI will not only focus on developing its AI, but will also work closely with its internal security and safety teams to ensure that effective and robust measures are in place to safeguard its platforms.
The company has made it clear that it will not only focus on its own environment, but will also continue to share its discoveries and advances with other industry players and the research community. This collaborative approach seeks to prevent similar situations from occurring in the future, fostering a safer and more reliable ecosystem for all users of data protection technologies. artificial intelligence.
While this initiative is being led by OpenAI, it is crucial that other industry leaders with their own generative AI platforms also adopt robust protection measures to prevent attacks that could compromise their systems.
Preventing these types of threats is an ongoing challenge, and it is essential that all companies involved in AI development implement proactive safeguards.
These measures should not only focus on solving problems once they occur, but on anticipating them to prevent them from arising in the first place. In this way, companies will be able to guarantee a safe and reliable experience for all their users, strengthening trust in artificial intelligence technologies and their transformative potential in society.
