Case ghostgpt-criminal-chatbotAI phishingWorldwide
GhostGPT: uncensored chatbot sold on Telegram to write malware and phishing for criminals
Abnormal Security documented GhostGPT, a jailbroken LLM wrapper sold via Telegram with a no-logs claim, that produced a convincing DocuSign phishing email on request and is marketed for malware and exploit work.
MediumAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jan 23, 2025
- Location
- Worldwide
- Target
- Businesses targeted by phishing and BEC
- Severity
- Medium
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Abnormal Security documented GhostGPT, a jailbroken LLM wrapper sold via Telegram with a no-logs claim, that produced a convincing DocuSign phishing email on request and is marketed for malware and exploit work.
Impact: Forum posts with thousands of views indicated real criminal demand; the tool lowered the barrier for BEC and phishing lures with no jailbreak skills needed.
Who triggered it
Actor: Unknown
Attribution: Abnormal Security researchers identified the service on underground forums; operator identity not established.
Motive: Selling uncensored AI access to cybercriminals for profit
How it happened
Attack vector: Telegram-delivered chatbot, likely a wrapper around a jailbroken commercial or open-source model, with guardrails removed
Root cause: Commercial LLM guardrails can be bypassed by wrapper services, giving low-skill actors ready-made phishing and malware generation
Timeline
- GhostGPT advertisements accumulate thousands of views on cybercrime forums
- Abnormal Security publishes analysis after testing the tool with a DocuSign phishing request
Response
Abnormal published indicators and warned defenders; no takedown reported.
Current status: Ongoing
Sources (open in a new tab)
- Abnormal AI abnormal.ai
- TechRepublic techrepublic.com
- Security Boulevard securityboulevard.com
Cite this case
GhostGPT: uncensored chatbot sold on Telegram to write malware and phishing for criminals. AI Threat Watch, case ghostgpt-criminal-chatbot, Jan 23, 2025. https://aithreat.io/cases/ghostgpt-criminal-chatbot/
Permanent link: https://aithreat.io/cases/ghostgpt-criminal-chatbot/