Loading story…
OpenAI banned a cluster of Russia-linked ChatGPT accounts that used VPNs to evade access restrictions while supporting a covert influence operation posing as the Israel-based International Burke Institute (IBI). The accounts used the model primarily to draft English-language promotional posts and replies and remove linguistic signs of Russian authorship, then distributed content through Substack, Telegram, X, Facebook, and LinkedIn.
IBI used a credible-looking website, a pro-Russian “Sovereignty Index,” and apparently copied or misattributed academic material to manufacture authority while portraying Russia favorably and criticizing Western countries. OpenAI assessed the campaign’s direct reach as low—despite affiliated Telegram channels having roughly 10,000 to 20,000 followers—but warned that its reusable infrastructure could enable a more scalable influence operation.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
OpenAI banned a cluster of ChatGPT accounts linked to a Russia-based covert influence operation promoting IBI. The operators used VPNs to evade Russian access restrictions and used ChatGPT primarily to create English-language promotional posts and comments while concealing linguistic signs of Russian authorship.
The website for the purported International Burke Institute (IBI), ibi[.]institute, was registered. The operation later used the site to present copied or misattributed academic material and pro-Russian narratives.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcetechrepublic.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcetomshardware.com
Open sourcethehackernews.com
Open sourceopenai.com
Open sourcecdn.openai.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI said it disrupted a small network of ChatGPT accounts linked to an operation it calls **“VAGue Focus,”** which used AI to generate social media posts, draft biographies, and translate outreach tied to apparent intelligence-gathering and social-engineering activity. According to the company, the actors posed as journalists, analysts, and consulting professionals associated with **Focus Lens News**, **BrightWave Media Europe**, and **Visionary Advisory Group**, and used the accounts to support outreach related to U.S. economic and financial policy topics. OpenAI reported that the operation used AI-generated content to build personas on **X** and to translate messages, including some outreach that offered payment for classified documents. Drawing on the broader challenge of measuring influence activity, the company assessed the public-facing influence component as **low impact**, citing little authentic engagement, while saying there was not enough evidence to determine whether the covert social-engineering effort succeeded.
Jul 31, 2026
OpenAI said two likely China-linked influence operations used ChatGPT to generate images and social media posts aimed at divisive U.S. debates over AI infrastructure and trade policy. The clusters, dubbed **"Data Center Bandwagon"** and **"Tech and Tariffs,"** produced English- and Chinese-language content that portrayed data center expansion as driving up electricity prices, straining power grids, consuming water, and harming the environment, while separate posts framed U.S. tariffs as a covert tool for controlling the global technology landscape. OpenAI said the operators likely originated in China, used VPNs, prompted ChatGPT in simplified Chinese, and posed as Americans on platforms including **X** and **YouTube**. OpenAI assessed that neither campaign achieved meaningful engagement and found no evidence the operators created the underlying controversies or materially shaped them, but the activity showed how AI tools can be used to amplify existing domestic disputes. The company also found the actors used ChatGPT for operational support, including editing work reports containing OPSEC details and discussing ways to exploit Facebook’s ecosystem and evade Meta’s coordinated inauthentic behavior detection. A separate analysis said the activity appeared tied to a private Chinese technology contractor serving provincial government clients, reflecting a deniable, scalable model aligned with broader Chinese propaganda patterns and strategic competition over U.S. AI and data center buildout.
Jul 31, 2026
OpenAI reported that a **ChatGPT account linked to Chinese law enforcement** used the model to review and edit internal write-ups on so-called **“cyber special operations,”** which OpenAI assessed as activity consistent with **covert influence operations and transnational repression** aimed at harassing and silencing critics of the Chinese Communist Party. The uploaded materials described a sustained, resource-intensive campaign involving **hundreds of staff**, **thousands of fake social-media accounts**, mass content generation, and tactics such as flooding platforms with fraudulent complaints against dissidents, forging documents, and in some cases **impersonating U.S. officials** to intimidate targets. OpenAI said the activity was tied to a single account, which it **banned**. OpenAI also described an attempted **smear/propaganda operation targeting Japanese Prime Minister Sanae Takaichi**, where the actor prompted ChatGPT for plans to amplify negative commentary on social media and to draft messages from fake accounts to pressure other Japanese politicians; when the model refused, the actor’s later prompts suggested the operation proceeded using other AI models. Separately, OpenAI attributed another cluster of accounts likely originating from mainland China that used ChatGPT to seek information on **U.S. persons, online forums, and federal building locations**, and to draft emails posing as a Hong Kong-based firm (*Nimbus Hub Consulting*), with OpenAI noting indicators such as VPN usage and prompts written in **Simplified Chinese**.
Jun 29, 2026