Case akirabot-openai-spamAI phishingWorldwide
AkiraBot uses GPT-4o-mini to spam 80,000 websites through contact forms and chat widgets
SentinelLABS exposed AkiraBot, a Python framework that scrapes each target site and asks OpenAI to write unique SEO spam, bypassing CAPTCHAs; it targeted 420,000 domains and hit at least 80,000 since September 2024.
MediumAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 9, 2025
- Location
- Worldwide
- Target
- Small business sites on Shopify, Wix, Squarespace, GoDaddy
- Severity
- Medium
- Triggered by
- AkiraBot operators
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
SentinelLABS exposed AkiraBot, a Python framework that scrapes each target site and asks OpenAI to write unique SEO spam, bypassing CAPTCHAs; it targeted 420,000 domains and hit at least 80,000 since September 2024.
Impact: At least 80,000 websites successfully spammed out of more than 420,000 unique domains targeted.
Who triggered it
Actor: AkiraBot operators
Attribution: SentinelLABS analysis of the framework and its archives; operators unidentified and unrelated to Akira ransomware.
Motive: Promoting dubious SEO services
How it happened
Attack vector: Automated form and chat submissions with LLM-generated messages, Selenium fingerprint spoofing, CAPTCHA-solving services and SmartProxy rotation
Root cause: Hardcoded OpenAI API keys and per-message generation defeated template-based spam filters and CAPTCHA defences
Timeline
- Earliest AkiraBot archives show campaign start
- SentinelLABS publishes analysis
- OpenAI disables the API key and investigates associated assets
Response
OpenAI revoked the key, saying distributing output for spam violates policy; SentinelLABS advised blocking rotating promo domains rather than relying on CAPTCHA.
Current status: Contained
Sources (open in a new tab)
- SentinelLABS sentinelone.com
- Infosecurity Magazine infosecurity-magazine.com
- Security Affairs securityaffairs.com
Cite this case
AkiraBot uses GPT-4o-mini to spam 80,000 websites through contact forms and chat widgets. AI Threat Watch, case akirabot-openai-spam, Apr 9, 2025. https://aithreat.io/cases/akirabot-openai-spam/
Permanent link: https://aithreat.io/cases/akirabot-openai-spam/