Cyber Operation: Korean-language malware support

This case study was originally published in OpenAI’s October 2025⁠(opens in a new window) report.

Actor

We identified and banned a cluster of ChatGPT accounts whose Korean-language operators attempted to use our models to engage in malware and command-and-control (C2) development. Indicators that we observed in our casework overlap with a Trellix report that tied similar activity to spear phishing campaigns against South Korean diplomatic missions, the deployment of XenoRAT malware, and the use of GitHub-based repositories for C2.

While the overlap with Trellix reporting, including the observed use of Korean language, activity consistent with the UTC+8 and UTC+9 time zones, and operational themes and topics, is consistent with the security community’s understanding of North Korean (DPRK) actors, we are not able to independently make an attribution, and we also block access to our services from North Korea.

Behavior

The accounts engaged with our models primarily in the Korean language, showing structured workflows with many accounts active in narrow time windows. Each of these accounts appears to have focused on a specific use case, for example converting Chrome extensions to Safari for Apple App Store publication, configuring Windows Server VPNs, or developing macOS Finder extensions, rather than each account spanning multiple technical areas.

We observed interactions with our models such as Windows API hooking, browser credential and cookie access workflows (DPAPI), and look-alike verification pages such as reCAPTCHA clones. We also saw draft phishing emails in Korean, often themed around cryptocurrency and designed to look like messages from government or financial service providers.

Completions

The threat actors generated model outputs that were designed to support multiple operational areas, including: