Loading story…
OpenAI introduced GPTs as customizable versions of ChatGPT and later launched the GPT Store, expanding distribution of user-built assistants that can combine custom instructions, uploaded knowledge files, and external Actions. A security analysis warns that those same features can be abused by malicious builders to make harmful GPTs appear trustworthy and scale attacks against end users through the platform.
Researchers demonstrated four attack paths: altering or misleading user-submitted text, serving malicious files through knowledge uploads, redirecting users to attacker-controlled websites via Actions, and covertly exfiltrating sensitive prompts or data to external infrastructure. The report says the abuse could support phishing, malware delivery, and theft of confidential information, and it urges users to avoid untrusted GPTs, verify domains and download links, and refrain from entering sensitive data, while calling on OpenAI to add stronger review, reputation, transparency, and warning mechanisms.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
MBSD published an analysis of how malicious Custom GPTs could attack benign users through text tampering, malicious file delivery, external-site redirection, and covert data exfiltration. The article also recommended user precautions and platform-side mitigations for OpenAI.
The research states that, as of 2024-02-26, GPTs did not have rating or review mechanisms to help users assess trustworthiness. It cites this as a gap that could make malicious GPTs harder for users to identify.
OpenAI opened the GPT Store to let users share and discover GPTs. The store expanded distribution of custom GPTs and increased the potential reach of malicious GPTs discussed in the research.
OpenAI released GPTs, allowing users to customize and publish specialized ChatGPT-based assistants. This launch created the feature set later analyzed for abuse, including Instructions, Knowledge uploads, and Actions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported that cybercriminals have started experimenting with **ChatGPT** to support malicious activity, using the tool to generate convincing phishing lures, draft fraudulent business communications, and assist with coding tasks tied to malware development. The report highlighted examples from underground forums showing threat actors discussing how large language models could lower the barrier for less-skilled operators by helping produce polished English text and functional code snippets. Researchers said the observed use was still early-stage, but the activity showed how generative AI could accelerate common cybercrime workflows, including social engineering, scripting, and evasion-oriented development. The findings underscored a growing risk for defenders: AI tools are being adapted not only for productivity and research, but also to improve the speed, scale, and professionalism of criminal campaigns.
Jun 29, 2026
Security researchers at Radware have uncovered critical vulnerabilities in OpenAI's ChatGPT platform, specifically targeting its Connectors and Memory features. These flaws, named ShadowLeak and ZombieAgent, allow attackers to exfiltrate sensitive data from connected services such as Gmail, Outlook, and GitHub without user interaction. The attacks exploit the AI's tendency to follow embedded malicious instructions, enabling zero-click and one-click data theft, persistent access through memory modification, and even propagation to other users by harvesting email addresses. OpenAI initially attempted to mitigate these vulnerabilities by restricting dynamic URL modifications, but researchers demonstrated effective bypasses using pre-built static URLs, reviving the threat under the new moniker ZombieAgent. The vulnerabilities highlight the inherent risks of integrating AI assistants with external systems and storing long-term user data for personalization. Attackers can embed hidden prompts in emails or files—using techniques like white text or tiny fonts—that are executed when ChatGPT processes the content, leading to stealthy data leaks via OpenAI's own servers. Despite OpenAI's efforts to patch the flaws, the reactive nature of these fixes has left the platform susceptible to new variants, underscoring the ongoing challenge of securing AI-driven services against prompt injection and data exfiltration attacks.
Jun 29, 2026
Sophos X-Ops found that cybercrime forums including Exploit, XSS, Breach Forums, and Hackforums are discussing large language models, but adoption remains limited and cautious. Researchers observed multiple GPT-branded services marketed to criminals—such as **WormGPT**, **FraudGPT**, **Evil-GPT**, **DarkGPT**, **WolfGPT**, **BlackHatGPT**, **HackBot**, **PentesterGPT**, **PrivateGPT**, and **XXXGPT**—yet many forum users questioned whether the tools were effective, accused some offerings of being scams, or dismissed them as little more than jailbreak prompts wrapped in criminal branding. The activity that did appear was largely experimental rather than operational. Sophos reported that most observed uses focused on social engineering, routine coding help, jailbreak attempts, and trading compromised ChatGPT accounts, while examples of AI-generated malware or attack tooling were rare, generally unsophisticated, and often Python-based. Forum participants also raised concerns that using ChatGPT could expose their activity to monitoring, leak operational details, or strengthen defensive systems, prompting some to favor offline or self-hosted models instead of mainstream AI services.
Jun 29, 2026