OpenAI Blog
Oct 1, 2025
Cyber Operation: Russian-speaking malware tooling
OpenAI banned accounts likely linked to Russian-speaking criminal groups, using AI to build malware loaders, evasion layers, credential-theft scripts, and C2 infrastructure.
Operation “ScopeCreep”: Russian-speaking malware development
OpenAI banned Russian-language accounts using AI to build malware, refine loaders, and troubleshoot cyber tooling.
Related stories
OpenAI Blog
Oct 1, 2025
Cyber Operation: Korean-language malware support
OpenAI banned Korean-language accounts using AI for malware development support, debugging, phishing, and credential-theft workflows.
OpenAI Blog
Oct 1, 2024
Hoax: Fake Russian “troll” error message
OpenAI banned an account that likely originated in the US and used AI to create a fake ChatGPT error message claiming to detect “Russian troll” activity.
OpenAI Blog
Jun 1, 2025
Operation “Helgoland Bite”: German-language influence activity
OpenAI banned accounts that appeared to originate in Russia and used AI to generate German-language political content about Ukraine, NATO, and domestic issues.
OpenAI Blog
May 1, 2024
"Bad Grammar": Russian-linked Telegram comment activity
OpenAI banned accounts linked to a previously unreprorted Russia-origin operation we dubbed "Bad Grammar", using AI to generate English- and Russian-language Telegram comments on Ukraine, Moldova, Baltic, and US politics.
OpenAI Blog
Aug 25
Disrupting a new covert influence campaign from Russia
OpenAI banned Russia-origin accounts using AI to promote a fake Israel-based think tank and a “sovereignty” index praising Russia and criticizing the West.
OpenAI Blog
May 1, 2024
Operation "Doppelganger": Russian influence activity targeting Ukraine
OpenAI banned accounts associated with the Russia-origin operation "Doppelganger", using AI to generate anti-Ukraine social media comments, translations, and website copy across several languages.
OpenAI Blog
Oct 1, 2024
Operation “Stop News”: Russia-origin influence activity
OpenAI banned Russia-origin “Stop News” accounts using AI to generate multilingual articles and posts targeting Ukraine and the West.
OpenAI Blog
Oct 1, 2024
STORM-0817: Iran-linked malware and scraping activity
OpenAI banned Iran-linked STORM-0817 accounts using AI to debug Android malware, scrape social platforms, and translate tooling.
OpenAI Blog
Jun 1, 2025
Vixen and Keyhole Panda: China-linked cyber operations
OpenAI banned accounts associated with threat actors publicly attributed to the PRC, using AI to support vulnerability research, scripting, translation, and operational troubleshooting.
OpenAI Blog
Feb 1
Operation “Trolling Stone”: Russia-linked influence activity
OpenAI banned accounts linked to a previously unreported operation we dubbed "Trolling Stone", using AI to generate comments about an alleged Russian cult leader’s arrest in Argentina.
OpenAI Blog
Oct 1, 2024
Corrupt Comment: Anti-corruption foundation criticism
OpenAI banned accounts using AI to generate comments criticizing a Russian anti-corruption foundation and related figures.