OpenAI's "ScopeCreep": Russian-Speaking Actor Used Disposable ChatGPT Accounts to Build C2-Enabled Windows Malware Distributed via a Trojanized "Crosshair-X" Gaming Tool

What Happened

In its June 2025 "Disrupting malicious uses of AI" threat intelligence report (published 2025-06-05), OpenAI disclosed that it had banned a cluster of ChatGPT accounts operated by what it assessed to be a Russian-speaking threat actor, in an operation OpenAI internally dubbed "ScopeCreep." The actor used ChatGPT over many separate, short-lived accounts, each created with a temporary email address and used for exactly one conversation focused on a single incremental code change before being abandoned, to iteratively develop, debug, and refine a Go-based Windows malware implant and its accompanying command-and-control (C2) server. The malware was distributed by uploading a version of it to a public code-hosting repository disguised as "Crosshair-X," a legitimate and popular crosshair/aim-overlay tool used by PC gamers. Victims who downloaded and ran the fake tool triggered a loader that pulled down further malicious components and executed a multi-stage chain covering privilege escalation, stealthy persistence, attacker notification, and data exfiltration, with several evasion techniques layered on top (DLL side-loading through pythonw.exe, Themida packing, Windows Defender exclusion abuse via PowerShell, non-standard-port HTTPS C2, and Telegram-based victim-compromise alerts). OpenAI states it detected the activity through its own scaled cyber-abuse detection process despite the actor's account-cycling opsec, coordinated with the code-hosting provider to remove the malicious repository, and banned every ChatGPT account tied to the cluster. No dollar losses, victim counts, or named organizational victims were disclosed; OpenAI assesses the campaign was likely caught in an early stage, with no evidence of widespread distribution despite some malware samples surfacing on VirusTotal.

How the Attack Worked

OpenAI describes ScopeCreep as a multi-stage, Go-based Windows malware family built and refined through sustained back-and-forth with ChatGPT rather than through traditional malware-authoring expertise alone. The actor treated the model as an iterative pair-programmer/debugger: pasting code snippets, stack traces, and crash output, and asking for specific incremental features one conversation at a time. Documented techniques (per OpenAI's TTP table, mapped to an LLM-ATT&CK-style framework) included: C2 payloads fetched via POST requests to a "/auth" endpoint, base64-encoded and padded with random bytes to defeat signature-based detection; stealthy execution by having a legitimate pythonw.exe interpreter side-load a malicious python310.dll via the Py_Main export, so the payload runs inside a trusted process; obfuscation/anti-analysis via the Themida commercial packer; privilege escalation by relaunching with ShellExecuteW; evasion via PowerShell commands (written with ChatGPT's help) that programmatically added the malware to Windows Defender's exclusion list, suppressed console windows, and inserted timing delays; network C2 over HTTPS but tunneled through port 80 with InsecureSkipVerify:true (indicating self-signed/invalid certificates) and a randomized user-agent per request; browser credential/token/cookie theft and exfiltration; a Telegram bot integration that alerted the operator whenever a new victim was compromised; and SOCKS5 proxying to mask the attacker's source IP and mimic the victim's apparent location. The operator also migrated their C2 backend from a Flask development server to a production-grade Gunicorn/WSGI deployment, again using ChatGPT to trouble-shoot the change. Distribution used a software-supply-chain / trojanized-tool vector, not phishing emails: the actor uploaded a version of a popular crosshair/aim-overlay tool for video games, "Crosshair-X," to a public code-hosting repository. Users who downloaded and ran the fake tool executed a loader that silently pulled down and ran the additional malicious components described above.

The Lure & the Tell

The lure was not a phishing message but a counterfeit software artifact: a version of the well-known gaming crosshair/overlay utility "Crosshair-X," uploaded to a public code-hosting repository, appealing to gamers looking for a free aim/overlay enhancement. The "tell" for anyone vetting third-party tools was structural rather than visual: the tool was hosted outside official distribution channels, executed a loader that reached out to attacker infrastructure to pull down further payloads, established persistence, and phoned home via a Telegram bot, none of which a legitimate crosshair overlay would need to do. OpenAI does not report any spoofed website, brand-lookalike domain, or social-engineering message accompanying the download; the trust exploited was generic trust in code repositories and free gaming utilities rather than a targeted pretext.

Outcome

OpenAI banned the entire cluster of ChatGPT accounts tied to the activity and coordinated with the (unnamed) code-hosting provider to take down the malicious "Crosshair-X" repository. OpenAI assesses the malware was likely active in the wild, with some samples surfacing on VirusTotal, but found no evidence of widespread interest, download volume, or distribution, and characterizes the disruption as having caught the operation in an early stage. No arrests, indictments, or named individual/group attribution have been publicly reported in connection with ScopeCreep as of the report and subsequent secondary coverage.

Why It Matters

ScopeCreep is one of the earliest documented, first-party-confirmed cases of a threat actor using a mainstream consumer LLM as an active malware-development and C2-engineering partner: not just for writing phishing lures, but for line-by-line coding, debugging, and infrastructure hardening of a working Windows implant. It illustrates two converging trends this repository tracks under "Agentic & AI-Driven": (1) AI compresses development time even for actors with real prior skill (OpenAI notes the actor "demonstrated knowledge of Windows internals," yet still leaned on sustained, incremental AI debugging to build out a working implant), and (2) attackers now apply account-level "operational security" to their AI usage itself, using one-shot disposable accounts, anticipating that AI vendors are watching for abuse patterns. It also demonstrates that the entry point for this AI-assisted intrusion tooling was an old-fashioned trust exploit: impersonating a trusted gaming utility in a public repository, showing that "agentic AI" attacks still typically ride on a conventional social-engineering or supply-chain hook to reach victims. Finally, it is a rare example of an AI vendor's own abuse-detection telemetry (rather than a victim, security vendor, or law enforcement) being the first line of defense that disrupted the operation.

Defenses

OpenAI: detected the cluster via its "scaled cyber abuse detection process" despite the actor's use of disposable accounts and one-conversation-per-account tradecraft; coordinated with the code-hosting provider to take down the malicious repository; banned all ChatGPT accounts tied to the activity; shared indicators with industry partners. OpenAI states the malware's actual capabilities (privilege escalation, persistence, credential harvesting, remote access) were "not particularly novel," and that despite some samples appearing on VirusTotal it saw no evidence of widespread distribution, crediting quick reporting and partner collaboration for limiting impact. General defenses implied for end users/orgs: only obtain gaming utilities/overlays from official, signed sources; treat unsigned "cheat"/overlay tools from third-party repos as high-risk; EDR/AV tuning to flag DLL side-loading through legitimate interpreters (e.g., pythonw.exe loading unexpected DLLs), PowerShell-driven Windows Defender exclusion changes, and outbound Telegram Bot API traffic from consumer endpoints; monitor for HTTPS traffic on non-standard port 80 with self-signed/invalid certs.