KawaiiGPT

key capabilities have been segmented into phishing automation, malware development, reconnaissance, brute force, vulnerability exploitation, and social engineering.

The resulting script does not introduce hugely novel capabilities, but it automates a standard, critical step in nearly every successful breach... as the generated code “authenticates as a legitimate user and grants the attacker a remote shell onto the new target machine.”

AI has made significantly easier... Drafting phishing lures... Threat actors use it to systematically design lookalike phishing pages... draft convincing spear-phishing lures.

Threat actors are adopting artificial intelligence to reduce time spent on attack vectors and improve the quality of attacks... Its application ranges from generating spear-phishing emails to lure images and dynamic payload generation executed in real time.

The researchers tested its capabilities using prompts instructing it to create: a spear-phishing message generation with realistic domain spoofing and credential-harvesting links.

a Python script for lateral movement that used the paramiko SSH library ... a Python script that recursively looked on a Windows filesystem for target files using os.walk, and then used Python’s smtplib library to pack and exfiltrate the data

The resulting script does not introduce hugely novel capabilities, but it automates a standard, critical step in nearly every successful breach... as the generated code “authenticates as a legitimate user and grants the attacker a remote shell onto the new target machine.”

The resulting script does not introduce hugely novel capabilities, but it automates a standard, critical step in nearly every successful breach... as the generated code “authenticates as a legitimate user and grants the attacker a remote shell onto the new target machine.”

The resulting script does not introduce hugely novel capabilities, but it automates a standard, critical step in nearly every successful breach... as the generated code “authenticates as a legitimate user and grants the attacker a remote shell onto the new target machine.”

Prompts produce credential-harvesting emails with professional formatting and subject lines such as "Urgent: Verify Your Account Information."

a Python script that recursively looked on a Windows filesystem for target files using os.walk

a Python script for lateral movement that used the paramiko SSH library to connect to a host and execute commands remotely via exec_command()

Sellers tout benefits such as... Python script for SSH lateral movement with remote shell access in under a minute.

Prompts produce credential-harvesting emails with professional formatting and subject lines such as "Urgent: Verify Your Account Information."

Data exfiltration prompts generate code that goes through every folder and subfolder to find EML files - the standard format for saved emails - and then uses Python's built-in email-sending tool smtplib to forward those files to an attacker.

the researchers warn that its command execution capability could allow attackers to escalate privileges, steal data, and drop and execute additional payloads.

Lateral movement requests generate Python scripts using paramiko for SSH authentication and remote shell access.

The script then sent the stolen files as email attachments to an attacker-controlled address.

used Python’s smtplib library to pack and exfiltrate the data to an attacker-controlled address

key capabilities have been segmented into phishing automation, malware development, reconnaissance, brute force, vulnerability exploitation, and social engineering.