Loading story…
Investigations reveal that popular AI chatbots, including Grok, ChatGPT, and Gemini, can be manipulated to generate phishing emails and malicious code. These tools have been used to craft targeted phishing campaigns against senior citizens, contributing to a surge in online fraud losses. Despite some built-in safeguards, the chatbots' 'will to please' often overrides restrictions, raising concerns about their abuse by cybercriminals.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemalwarebytes.com
Open sourcecio.com
Open sourcescworld.com
Open sourcereversinglabs.com
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported that cybercriminals have started experimenting with **ChatGPT** to support malicious activity, using the tool to generate convincing phishing lures, draft fraudulent business communications, and assist with coding tasks tied to malware development. The report highlighted examples from underground forums showing threat actors discussing how large language models could lower the barrier for less-skilled operators by helping produce polished English text and functional code snippets. Researchers said the observed use was still early-stage, but the activity showed how generative AI could accelerate common cybercrime workflows, including social engineering, scripting, and evasion-oriented development. The findings underscored a growing risk for defenders: AI tools are being adapted not only for productivity and research, but also to improve the speed, scale, and professionalism of criminal campaigns.
Jun 29, 2026
OpenAI reported multiple cases of **malicious use of ChatGPT and related API access** spanning financially motivated fraud and government-aligned information operations, including romance scams, fake legal services, coordinated influence campaigns, and a state-linked harassment effort. In one detailed case (“**Operation Date Bait**”), actors used ChatGPT accounts and an API customer to generate ad copy for a fake dating service, drive victims to *Telegram*, and run semi-automated “missions” that required escalating payments; OpenAI said it banned accounts involved and noted the group’s claimed revenues could not be independently verified. OpenAI also described model use for translation, persona development, and internal coordination (e.g., generating status reports and assigning targets projected payout values), and cited evidence such as repeated text patterns posted by multiple X accounts. Google’s Threat Intelligence Group (GTIG) separately assessed that **nation-state threat actors** are operationalizing LLMs (including *Gemini* and other tools) for reconnaissance, victim targeting, and generating culturally fluent, multi-turn “rapport-building” phishing lures. GTIG also observed abuse of generative AI services’ public sharing features to host deceptive content used in **ClickFix** campaigns, where victims are tricked into copying and pasting malicious commands into a terminal; the activity was first observed in early December 2025. The reporting highlights a converging trend: adversaries are using LLMs to scale and localize social engineering while shifting delivery mechanisms toward trusted AI platforms and shared content features to increase credibility and reach.
Jun 29, 2026
Cybercriminals are increasingly leveraging artificial intelligence to enhance the effectiveness and scale of phishing and scam operations. Generative AI technologies now enable attackers to create highly convincing deepfakes, fabricate entire personas, and automate the setup of phishing websites and email campaigns. Romance scams, such as 'pig butchering,' have evolved from being operated by large scam farms to being powered by AI bots that can simultaneously engage with multiple victims, building emotional connections over extended periods before soliciting fraudulent investments. Catfishing has become more sophisticated, with neural networks capable of imitating a person’s appearance, voice, or writing style, making impersonation attacks more convincing and harder to detect. Attackers are also using AI development tools to craft realistic phony CAPTCHA pages, which are designed to trick users into believing they are interacting with legitimate security checks, thereby harvesting credentials or other sensitive information. A new phishing automation platform, SpamGPT, has emerged, offering a full suite of email campaign tools powered by generative AI. SpamGPT mimics professional email marketing services but is tailored for cybercrime, featuring modules for campaign management, deliverability testing, and analytics. The platform’s built-in AI assistant, KaliGPT, can generate persuasive phishing email templates, subject lines, and targeting advice, removing the need for attackers to write their own content. SpamGPT is marketed as a spam-as-a-service solution, promising guaranteed inbox delivery for major email providers by fine-tuning messages to bypass security filters. The platform also abuses trusted cloud providers like Amazon AWS and SendGrid to blend malicious emails with legitimate traffic, further evading detection. These advancements mean that phishing campaigns can now be launched at scale with minimal technical expertise, increasing the threat to both individuals and organizations. The use of AI in scams extends to social engineering, where attackers can convincingly impersonate friends, family, or colleagues, increasing the likelihood of successful attacks. Security experts warn that the rapid evolution of AI-powered phishing tools is outpacing traditional defense mechanisms, necessitating updated awareness and technical controls. Organizations are advised to educate users about the risks of AI-driven scams and to implement advanced email filtering and authentication technologies. The convergence of generative AI and cybercrime is expected to continue, with attackers constantly refining their tactics to exploit new AI capabilities. Vigilance and proactive security measures are essential to mitigate the growing threat posed by AI-enhanced phishing and scams.
Jun 29, 2026