OpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool. How it worked.
Social Engineering Examples·5 sources
ScopeCreep is a case of malware built with ChatGPT and hidden inside a fake gaming tool. In June 2025, OpenAI said it had banned a cluster of ChatGPT accounts run by what it assessed was a Russian-speaking actor. The actor used throwaway accounts, one conversation each, to write and debug Windows malware in Go and the server that controlled it. The malware went out on a public code site, dressed up as "Crosshair-X", a popular crosshair overlay for PC gamers. OpenAI says it caught the operation early. Status: Disrupted by OpenAI; no victims named.
Think of it as a pair programmer that never asked why. The actor pasted in code, error messages and crash output, and asked for one feature or fix at a time. Each account was opened with a temporary email address, used for a single conversation, then abandoned. OpenAI noted the actor already "demonstrated knowledge of Windows internals". ChatGPT helped them move faster, including writing PowerShell to hide the malware from Windows Defender and moving their control server from a Flask test setup to a production Gunicorn deployment.
Tip: only download game tools, overlays and "cheats" from the official site or store. A copy on a random repository is a different program.
| Stage | Technique, per OpenAI |
|---|---|
| Lure | A version of Crosshair-X uploaded to a public code repository |
| Load | Running it started a loader that pulled down more malicious parts |
| Hide | A trusted pythonw.exe loaded a malicious python310.dll. The code was packed with Themida |
| Escalate | Relaunched itself with higher rights via ShellExecuteW |
| Evade | PowerShell added it to Windows Defender's exclusion list, hid console windows and added delays |
| Talk | HTTPS over port 80 with self-signed certificates, random user agents, and payloads padded with random bytes |
| Steal | Browser credentials, tokens and cookies |
| Alert | A Telegram bot told the operator every time a new victim was hit |
| Mask | SOCKS5 proxies to hide the attacker's location |
None of that needed a phishing email. The trust being exploited was general trust in code repositories and free gaming add-ons. OpenAI reported no fake website or lookalike domain.
OpenAI spotted the cluster through its "scaled cyber abuse detection process", despite the account cycling. It banned every linked account and worked with the code-hosting site, which it didn't name, to remove the fake repository. Some samples had shown up on VirusTotal, so the malware was likely live. But OpenAI says it saw no sign of wide distribution. No financial figure was given, and that shouldn't be read as proof nobody lost anything.
OpenAI didn't name the actor. "Russian-speaking" is based on language in the conversations, not confirmed nationality or state backing.
See also AI-generated malware, supply chain social engineering and LAMEHUG.
OpenAI's name for a Russian-speaking actor who used throwaway ChatGPT accounts to build Windows malware, spread as a fake version of the Crosshair-X gaming tool.
It helped. The actor used it to write, debug and refine code step by step. OpenAI said the resulting capabilities weren't particularly novel.
OpenAI's abuse detection flagged the accounts. It banned them and had the fake repository taken down.
PC gamers who downloaded the fake Crosshair-X tool. No specific victims were named.
Social Engineering Examples. “ScopeCreep: malware built with ChatGPT and hidden in a fake gaming tool (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/openai-scopecreep-crosshair-x-trojan-2025
The threat actor identified a popular, trusted gaming utility, the "Crosshair-X" crosshair/aim-overlay tool, to impersonate, consistent with a supply-chain-style approach that trades a targeted pretext for broad, trust-based reach into the existing user base of a real tool.
Which existing, trusted tool an attacker chooses to impersonate is effectively unpredictable and outside any single defender's control; the realistic countermeasures sit downstream at distribution and execution (Stages 6 and 7), where unsigned-binary and code-provenance controls can actually intercept the trojanized package.
Per OpenAI, the actor signed up for ChatGPT using temporary/disposable email addresses, limiting each account to a single conversation covering one incremental code change before abandoning it and creating a new one, apparently to limit any single account's visibility into the overall project and evade abuse detection.
This is the one stage where the defender (OpenAI) had direct visibility: its own scaled cyber-abuse detection process identified the cluster's activity despite the one-conversation-per-disposable-account tradecraft, leading to a ban of every account tied to it.
The actor used ChatGPT as an iterative pair-programmer, pasting Go code, stack traces, and crash output for the model to debug, and building out the Windows implant's capabilities (privilege escalation, persistence, credential theft) one requested feature at a time.
The same AI-vendor abuse-detection telemetry is the operative control here too, since no outside organization can see another vendor's chat logs; once the resulting binary reaches a network, standard EDR/behavioral detection on the implant itself becomes the backstop.
ChatGPT was used to help build and later migrate the command-and-control backend from a Flask development server to a production Gunicorn/WSGI deployment, troubleshoot TLS certificate handling (cert.pem/key.pem) for HTTPS-over-port-80 delivery, and design a base64-encoded, randomly-padded payload-delivery scheme via a /auth POST endpoint intended to defeat signature-based detection.
Network-side monitoring for HTTPS traffic on non-standard port 80 with self-signed or invalid TLS certificates, and for outbound connections to unfamiliar C2-style /auth endpoints, can flag this infrastructure pattern even without knowing the payload's exact contents.
The actor used ChatGPT to write PowerShell logic (invoked from Go) that programmatically added Windows Defender AV exclusions, suppressed console windows, and inserted timing delays, and to compile python310.dll so its code executed whenever python.exe ran; Themida commercial packing was another technique intended to defeat static and dynamic analysis.
EDR/AV tuning to flag DLL side-loading through legitimate interpreters (e.g., pythonw.exe loading unexpected DLLs), scripted or PowerShell-driven changes to Windows Defender's exclusion list, and the presence of commercial packers like Themida on unsigned binaries directly targets this stage's techniques.
The finished malware was uploaded to a public code-hosting repository disguised as the legitimate "Crosshair-X" tool, relying on gamers discovering and downloading it organically rather than any direct outreach or phishing message.
Sourcing gaming utilities and overlays only from official, signed distribution channels, and treating unsigned "cheat"/overlay tools hosted on public code repositories as high-risk regardless of how legitimate their branding looks, removes the trust the impersonation depends on.
A user who downloaded and ran the fake "Crosshair-X" package triggered a loader that reached out to attacker infrastructure and pulled down the additional malicious components.
Application allow-listing and code-signing enforcement that blocks unsigned executables from running, paired with user-facing awareness that free gaming utilities from public repos are a common malware vector, would stop the loader before it can call out to attacker infrastructure.
The malware relaunched itself via ShellExecuteW to escalate privileges, added itself to the Windows Defender exclusion list, and routed traffic through SOCKS5 proxies to mask the attacker's source IP and mimic the victim's apparent location.
EDR monitoring for anomalous ShellExecuteW-based relaunches, unexpected Windows Defender exclusion changes, and SOCKS5-proxied outbound connections from consumer endpoints can catch the malware after execution but before objective completion.
The malware harvested browser-stored credentials, session tokens, and cookies and exfiltrated them over the covert HTTPS/port-80 channel, while a Telegram bot integration alerted the operator whenever a new victim was compromised, completing the attacker's goal of ongoing remote access and credential harvesting.
Browser/OS credential-store hardening and monitoring for bulk credential or cookie access, plus flagging outbound Telegram Bot API traffic from consumer endpoints as an indicator of compromise, per OpenAI's own stated defenses, can catch exfiltration and attacker notification even after the host is compromised.
Browse by what this case has in common with others in the library.
ESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
Anthropic says a UK cybercriminal used Claude to build ransomware they couldn't write alone, then sold kits for $400 to…
In 2015, fake emails from Ubiquiti's CEO and a real London lawyer got its finance chief to wire $46.7M. How…
A job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What…
In June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX…
Chinese state-linked hackers used spear-phishing links and an unpatched Internet Explorer zero-day to breach Google, Adobe, and dozens of other…
The EA data breach began in June 2021, when hackers used a Slack session cookie they said cost $10 to…
A Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a…
A job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What…
In March 2022, LAPSUS$ (DEV-0537) leaked an archive it said held 37GB of Microsoft source code. Microsoft only confirmed that…
Orlando police pulled about 200 fake QR stickers off downtown parking meters in June 2025. How to spot them: white…
Fraudsters impersonating FACC's CEO by email convinced finance staff to wire roughly EUR 50M for a fake acquisition project; EUR…
Orion S.A. lost about $60M in 2024 when an employee was tricked into wiring money to criminals. What Orion confirmed,…
A Ukrainian-language "shared document" phishing wave used a fake reCAPTCHA "verify you are human" ClickFix page to trick victims into…
Argan's Fiscal 2024 cybersecurity disclosure described fraudulently induced outbound wire transfers in March 2023 and reported $2.7 million of loss,…
The SEC's 2018 Section 21(a) report detailed how fake-executive and fake-vendor BEC emails caused nearly $100 million in combined losses…
Social Engineering Examples