OpenAI Blog
Oct 1, 2025
Cyber Operation: Russian-speaking malware tooling
OpenAI banned accounts likely linked to Russian-speaking criminal groups, using AI to build malware loaders, evasion layers, credential-theft scripts, and C2 infrastructure.
Cyber Operation: Korean-language malware support
OpenAI banned Korean-language accounts using AI for malware development support, debugging, phishing, and credential-theft workflows.
Related stories
OpenAI Blog
Jun 1, 2025
Operation “ScopeCreep”: Russian-speaking malware development
OpenAI banned Russian-language accounts using AI to build malware, refine loaders, and troubleshoot cyber tooling.
OpenAI Blog
Oct 1, 2025
Cyber Operation: Phishing and scripting support
OpenAI banned accounts involved in activity that overlapped with publicly reported threat groups and displayed hallmarks consistent with PRC intelligence requirements, using AI to support phishing and scripting workflows.
OpenAI Blog
Jun 1, 2025
Vixen and Keyhole Panda: China-linked cyber operations
OpenAI banned accounts associated with threat actors publicly attributed to the PRC, using AI to support vulnerability research, scripting, translation, and operational troubleshooting.
OpenAI Blog
Oct 1, 2024
SweetSpecter: China-linked cyber activity
OpenAI banned accounts likely belonging to a suspected China-based adversary tracked as SweetSpecter, using AI to research vulnerabilities, write code, and support spear-phishing activity.
OpenAI Blog
Oct 1, 2025
Scam operations: Online fraud networks
OpenAI banned accounts tied to online fraud networks using AI to support scam scripts, impersonation, translation, and victim engagement.
OpenAI Blog
Jun 1, 2025
Operation “Wrong Number”: AI-assisted task scam
OpenAI banned accounts that likely originated in Cambodia and used AI to support scam workflows targeting people in the UK.
OpenAI Blog
Oct 1, 2024
STORM-0817: Iran-linked malware and scraping activity
OpenAI banned Iran-linked STORM-0817 accounts using AI to debug Android malware, scrape social platforms, and translate tooling.
OpenAI Blog
Oct 1, 2024
CyberAv3ngers: Iran-linked cyber research activity
OpenAI banned accounts that appeared to belong to CyberAv3ngers using AI to research industrial control systems, default credentials, and targets.
OpenAI Blog
Feb 1, 2025
Task scam: AI-assisted fake review jobs
OpenAI banned accounts that appeared to originate in Cambodia and used AI to translate messages for fake-review job scams that asked victims to pay fees.
OpenAI Blog
Feb 1, 2025
Operation “Sponsored Discontent”: Influence activity
OpenAI banned likely China-origin accounts using AI to generate English social posts and Spanish-language articles.
OpenAI Blog
Feb 1, 2025
Cyber threat actors: AI-assisted intrusion research
OpenAI banned accounts potentially associated with publicly reported DPRK-affiliated threat actors using AI to research intrusion tooling, phishing, malware, and cryptocurrency targeting.