A Russian-speaking threat actor used disposable, one-conversation ChatGPT accounts to iteratively build and debug a Go-based Windows malware family.
Social Engineering Examples·5 sources
In its June 2025 "Disrupting malicious uses of AI" threat intelligence report (published 2025-06-05), OpenAI disclosed that it had banned a cluster of ChatGPT accounts operated by what it assessed to be a Russian-speaking threat actor, in an operation OpenAI internally dubbed "ScopeCreep." The actor used ChatGPT over many separate, short-lived accounts, each created with a temporary email address and used for exactly one conversation focused on a single incremental code change before being abandoned, to iteratively develop, debug, and refine a Go-based Windows malware implant and its accompanying command-and-control (C2) server.
The malware was distributed by uploading a version of it to a public code-hosting repository disguised as "Crosshair-X," a legitimate and popular crosshair/aim-overlay tool used by PC gamers. Victims who downloaded and ran the fake tool triggered a loader that pulled down further malicious components and executed a multi-stage chain covering privilege escalation, stealthy persistence, attacker notification, and data exfiltration, with several evasion techniques layered on top (DLL side-loading through pythonw.exe, Themida packing, Windows Defender exclusion abuse via PowerShell, non-standard-port HTTPS C2, and Telegram-based victim-compromise alerts).
OpenAI states it detected the activity through its own scaled cyber-abuse detection process despite the actor's account-cycling opsec, coordinated with the code-hosting provider to remove the malicious repository, and banned every ChatGPT account tied to the cluster. No dollar losses, victim counts, or named organizational victims were disclosed; OpenAI assesses the campaign was likely caught in an early stage, with no evidence of widespread distribution despite some malware samples surfacing on VirusTotal.
OpenAI describes ScopeCreep as a multi-stage, Go-based Windows malware family built and refined through sustained back-and-forth with ChatGPT rather than through traditional malware-authoring expertise alone. The actor treated the model as an iterative pair-programmer/debugger: pasting code snippets, stack traces, and crash output, and asking for specific incremental features one conversation at a time.
Documented techniques (per OpenAI's TTP table, mapped to an LLM-ATT&CK-style framework) included: C2 payloads fetched via POST requests to a "/auth" endpoint, base64-encoded and padded with random bytes to defeat signature-based detection; stealthy execution by having a legitimate pythonw.exe interpreter side-load a malicious python310.dll via the Py_Main export, so the payload runs inside a trusted process; obfuscation/anti-analysis via the Themida commercial packer; privilege escalation by relaunching with ShellExecuteW; evasion via PowerShell commands (written with ChatGPT's help) that programmatically added the malware to Windows Defender's exclusion list, suppressed console windows, and inserted timing delays; network C2 over HTTPS but tunneled through port 80 with InsecureSkipVerify:true (indicating self-signed/invalid certificates) and a randomized user-agent per request; browser credential/token/cookie theft and exfiltration; a Telegram bot integration that alerted the operator whenever a new victim was compromised; and SOCKS5 proxying to mask the attacker's source IP and mimic the victim's apparent location.
The operator also migrated their C2 backend from a Flask development server to a production-grade Gunicorn/WSGI deployment, again using ChatGPT to trouble-shoot the change. Distribution used a software-supply-chain / trojanized-tool vector, not phishing emails: the actor uploaded a version of a popular crosshair/aim-overlay tool for video games, "Crosshair-X," to a public code-hosting repository.
Users who downloaded and ran the fake tool executed a loader that silently pulled down and ran the additional malicious components described above.
The lure was not a phishing message but a counterfeit software artifact: a version of the well-known gaming crosshair/overlay utility "Crosshair-X," uploaded to a public code-hosting repository, appealing to gamers looking for a free aim/overlay enhancement. The "tell" for anyone vetting third-party tools was structural rather than visual: the tool was hosted outside official distribution channels, executed a loader that reached out to attacker infrastructure to pull down further payloads, established persistence, and phoned home via a Telegram bot, none of which a legitimate crosshair overlay would need to do.
OpenAI does not report any spoofed website, brand-lookalike domain, or social-engineering message accompanying the download; the trust exploited was generic trust in code repositories and free gaming utilities rather than a targeted pretext.
OpenAI banned the entire cluster of ChatGPT accounts tied to the activity and coordinated with the (unnamed) code-hosting provider to take down the malicious "Crosshair-X" repository. OpenAI assesses the malware was likely active in the wild, with some samples surfacing on VirusTotal, but found no evidence of widespread interest, download volume, or distribution, and characterizes the disruption as having caught the operation in an early stage.
No arrests, indictments, or named individual/group attribution have been publicly reported in connection with ScopeCreep as of the report and subsequent secondary coverage.
ScopeCreep is one of the earliest documented, first-party-confirmed cases of a threat actor using a mainstream consumer LLM as an active malware-development and C2-engineering partner: not just for writing phishing lures, but for line-by-line coding, debugging, and infrastructure hardening of a working Windows implant. It illustrates two converging trends this repository tracks under "Agentic & AI-Driven": (1) AI compresses development time even for actors with real prior skill (OpenAI notes the actor "demonstrated knowledge of Windows internals," yet still leaned on sustained, incremental AI debugging to build out a working implant), and (2) attackers now apply account-level "operational security" to their AI usage itself, using one-shot disposable accounts, anticipating that AI vendors are watching for abuse patterns.
It also demonstrates that the entry point for this AI-assisted intrusion tooling was an old-fashioned trust exploit: impersonating a trusted gaming utility in a public repository, showing that "agentic AI" attacks still typically ride on a conventional social-engineering or supply-chain hook to reach victims. Finally, it is a rare example of an AI vendor's own abuse-detection telemetry (rather than a victim, security vendor, or law enforcement) being the first line of defense that disrupted the operation.
OpenAI: detected the cluster via its "scaled cyber abuse detection process" despite the actor's use of disposable accounts and one-conversation-per-account tradecraft; coordinated with the code-hosting provider to take down the malicious repository; banned all ChatGPT accounts tied to the activity; shared indicators with industry partners. OpenAI states the malware's actual capabilities (privilege escalation, persistence, credential harvesting, remote access) were "not particularly novel," and that despite some samples appearing on VirusTotal it saw no evidence of widespread distribution, crediting quick reporting and partner collaboration for limiting impact.
General defenses implied for end users/orgs: only obtain gaming utilities/overlays from official, signed sources; treat unsigned "cheat"/overlay tools from third-party repos as high-risk; EDR/AV tuning to flag DLL side-loading through legitimate interpreters (e.g., pythonw.exe loading unexpected DLLs), PowerShell-driven Windows Defender exclusion changes, and outbound Telegram Bot API traffic from consumer endpoints; monitor for HTTPS traffic on non-standard port 80 with self-signed/invalid certs.
Social Engineering Examples. “OpenAI's "ScopeCreep": Russian-Speaking Actor Used Disposable ChatGPT Accounts to Build C2-Enabled Windows Malware Distributed via a Trojanized "Crosshair-X" Gaming Tool”. Accessed 19 September 2026. https://socialengineeringexamples.com/openai-scopecreep-crosshair-x-trojan-2025
The threat actor identified a popular, trusted gaming utility, the "Crosshair-X" crosshair/aim-overlay tool, to impersonate, consistent with a supply-chain-style approach that trades a targeted pretext for broad, trust-based reach into the existing user base of a real tool.
Which existing, trusted tool an attacker chooses to impersonate is effectively unpredictable and outside any single defender's control; the realistic countermeasures sit downstream at distribution and execution (Stages 6 and 7), where unsigned-binary and code-provenance controls can actually intercept the trojanized package.
Per OpenAI, the actor signed up for ChatGPT using temporary/disposable email addresses, limiting each account to a single conversation covering one incremental code change before abandoning it and creating a new one, apparently to limit any single account's visibility into the overall project and evade abuse detection.
This is the one stage where the defender (OpenAI) had direct visibility: its own scaled cyber-abuse detection process identified the cluster's activity despite the one-conversation-per-disposable-account tradecraft, leading to a ban of every account tied to it.
The actor used ChatGPT as an iterative pair-programmer, pasting Go code, stack traces, and crash output for the model to debug, and building out the Windows implant's capabilities (privilege escalation, persistence, credential theft) one requested feature at a time.
The same AI-vendor abuse-detection telemetry is the operative control here too, since no outside organization can see another vendor's chat logs; once the resulting binary reaches a network, standard EDR/behavioral detection on the implant itself becomes the backstop.
ChatGPT was used to help build and later migrate the command-and-control backend from a Flask development server to a production Gunicorn/WSGI deployment, troubleshoot TLS certificate handling (cert.pem/key.pem) for HTTPS-over-port-80 delivery, and design a base64-encoded, randomly-padded payload-delivery scheme via a /auth POST endpoint intended to defeat signature-based detection.
Network-side monitoring for HTTPS traffic on non-standard port 80 with self-signed or invalid TLS certificates, and for outbound connections to unfamiliar C2-style /auth endpoints, can flag this infrastructure pattern even without knowing the payload's exact contents.
The actor used ChatGPT to write PowerShell logic (invoked from Go) that programmatically added Windows Defender AV exclusions, suppressed console windows, and inserted timing delays, alongside separate design choices (Themida commercial packing, DLL side-loading of a malicious python310.dll through the legitimate pythonw.exe interpreter) intended to defeat static and dynamic analysis.
EDR/AV tuning to flag DLL side-loading through legitimate interpreters (e.g., pythonw.exe loading unexpected DLLs), scripted or PowerShell-driven changes to Windows Defender's exclusion list, and the presence of commercial packers like Themida on unsigned binaries directly targets this stage's techniques.
The finished malware was uploaded to a public code-hosting repository disguised as the legitimate "Crosshair-X" tool, relying on gamers discovering and downloading it organically rather than any direct outreach or phishing message.
Sourcing gaming utilities and overlays only from official, signed distribution channels, and treating unsigned "cheat"/overlay tools hosted on public code repositories as high-risk regardless of how legitimate their branding looks, removes the trust the impersonation depends on.
A user who downloaded and ran the fake "Crosshair-X" package triggered a loader that reached out to attacker infrastructure and pulled down the additional malicious components.
Application allow-listing and code-signing enforcement that blocks unsigned executables from running, paired with user-facing awareness that free gaming utilities from public repos are a common malware vector, would stop the loader before it can call out to attacker infrastructure.
The malware relaunched itself via ShellExecuteW to escalate privileges, added itself to the Windows Defender exclusion list, and routed traffic through SOCKS5 proxies to mask the attacker's source IP and mimic the victim's apparent location.
EDR monitoring for anomalous ShellExecuteW-based relaunches, unexpected Windows Defender exclusion changes, and SOCKS5-proxied outbound connections from consumer endpoints can catch the malware after execution but before objective completion.
The malware harvested browser-stored credentials, session tokens, and cookies and exfiltrated them over the covert HTTPS/port-80 channel, while a Telegram bot integration alerted the operator whenever a new victim was compromised, completing the attacker's goal of ongoing remote access and credential harvesting.
Browser/OS credential-store hardening and monitoring for bulk credential or cookie access, plus flagging outbound Telegram Bot API traffic from consumer endpoints as an indicator of compromise, per OpenAI's own stated defenses, can catch exfiltration and attacker notification even after the host is compromised.
Browse by what this case has in common with others in the library.
ESET researchers found "PromptLock," a Go-based ransomware sample on VirusTotal that used a locally-run open-weight AI model.
Google's GTIG and Ukraine's CERT-UA documented PROMPTSTEAL (aka LAMEHUG).
A lone, unidentified hacker jailbroke Anthropic's Claude Code coding agent with a fake "authorized bug bounty/pentest" pretext and paired it.
A Lapsus$ affiliate bought a contractor's stolen Uber password, flooded them with MFA push prompts, then posed as Uber IT…
Fraudsters impersonating Ubiquiti's CEO and an outside law firm tricked its Hong Kong finance controller into wiring $46.7M abroad.
A victim searching for the AnyDesk remote-access tool hit a typosquatted site with a fake Cloudflare Turnstile.
DOJ/IRS-CI unsealed four indictments charging 28 members of a Chinese organized-crime money-laundering ring tied to India-based "mistaken refund".
Fraudsters impersonating Ubiquiti's CEO and an outside law firm tricked its Hong Kong finance controller into wiring $46.7M abroad.
Attackers phoned Twitter employees posing as IT help desk, harvested VPN credentials.
Scammers impersonating Southern California Edison used real-time-negotiated "pay now or we shut off your power in 30 minutes" phone and…
In June 2025 the DOJ filed a civil forfeiture complaint against more than $225.3M in Tether (USDT) traced to a…
Social Engineering Examples