OpenAI Blog
Oct 1, 2025
Cyber Operation: Russian-speaking malware tooling
OpenAI banned accounts likely linked to Russian-speaking criminal groups, using AI to build malware loaders, evasion layers, credential-theft scripts, and C2 infrastructure.
Operation “ScopeCreep”: Russian-speaking malware development
OpenAI banned Russian-language accounts using AI to build malware, refine loaders, and troubleshoot cyber tooling.
Related stories
OpenAI Blog
Oct 1, 2025
Cyber Operation: Korean-language malware support
OpenAI banned Korean-language accounts using AI for malware development support, debugging, phishing, and credential-theft workflows.
OpenAI Blog
Oct 1, 2024
Hoax: Fake Russian “troll” error message
OpenAI banned an account that likely originated in the US and used AI to create a fake ChatGPT error message claiming to detect “Russian troll” activity.
OpenAI Blog
Jun 1, 2025
Operation “Helgoland Bite”: German-language influence activity
OpenAI banned accounts that appeared to originate in Russia and used AI to generate German-language political content about Ukraine, NATO, and domestic issues.
OpenAI Blog
May 1, 2024
"Bad Grammar": Russian-linked Telegram comment activity
OpenAI banned accounts linked to a previously unreprorted Russia-origin operation we dubbed "Bad Grammar", using AI to generate English- and Russian-language Telegram comments on Ukraine, Moldova, Baltic, and US politics.
OpenAI Blog
May 1, 2024
Operation "Doppelganger": Russian influence activity targeting Ukraine
OpenAI banned accounts associated with the Russia-origin operation "Doppelganger", using AI to generate anti-Ukraine social media comments, translations, and website copy across several languages.
OpenAI Blog
Oct 1, 2024
Operation “Stop News”: Russia-origin influence activity
OpenAI banned Russia-origin “Stop News” accounts using AI to generate multilingual articles and posts targeting Ukraine and the West.
OpenAI Blog
Oct 1, 2024
STORM-0817: Iran-linked malware and scraping activity
OpenAI banned Iran-linked STORM-0817 accounts using AI to debug Android malware, scrape social platforms, and translate tooling.
OpenAI Blog
Jun 1, 2025
Vixen and Keyhole Panda: China-linked cyber operations
OpenAI banned accounts associated with threat actors publicly attributed to the PRC, using AI to support vulnerability research, scripting, translation, and operational troubleshooting.
OpenAI Blog
Oct 1, 2024
Corrupt Comment: Anti-corruption foundation criticism
OpenAI banned accounts using AI to generate comments criticizing a Russian anti-corruption foundation and related figures.
OpenAI Blog
Oct 1, 2024
CyberAv3ngers: Iran-linked cyber research activity
OpenAI banned accounts that appeared to belong to CyberAv3ngers using AI to research industrial control systems, default credentials, and targets.
OpenAI Blog
Oct 1, 2024
SweetSpecter: China-linked cyber activity
OpenAI banned accounts likely belonging to a suspected China-based adversary tracked as SweetSpecter, using AI to research vulnerabilities, write code, and support spear-phishing activity.