Case openai-dprk-korean-c2-phishingState actor AI opsSouth Korea
North Korea-linked cluster used ChatGPT for C2 tooling in phishing of Seoul's diplomats
Korean-language accounts aligned with known DPRK phishing campaigns against South Korean diplomats used ChatGPT to develop C2 malware, macOS extensions, Windows Server VPN configs and credential-theft tooling.
HighAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 7, 2025
- Location
- South Korea
- Target
- South Korean diplomatic entities
- Severity
- High
- Triggered by
- North Korea-linked phishing cluster
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Korean-language accounts aligned with known DPRK phishing campaigns against South Korean diplomats used ChatGPT to develop C2 malware, macOS extensions, Windows Server VPN configs and credential-theft tooling.
Impact: Tooling for an active diplomatic phishing campaign; victim compromises not quantified.
Who triggered it
Actor: North Korea-linked phishing cluster
Attribution: OpenAI aligned the cluster with publicly reported DPRK campaigns against South Korean diplomatic targets.
Motive: Espionage
How it happened
Attack vector: LLM-assisted development of C2 infrastructure and browser-extension conversion for phishing
Root cause: Developer-style requests for C2 and extension code were not individually blocked
Timeline
- The Hacker News and ThaiCERT relay the DPRK attribution
- OpenAI suspends the accounts and publishes the case
Response
Accounts suspended; OpenAI shared findings with partners.
Current status: Contained
Sources (open in a new tab)
- OpenAI October 2025 report PDF cdn.openai.com
- ThaiCERT repost of The Hacker News thaicert.or.th
- SiliconANGLE coverage siliconangle.com
Cite this case
North Korea-linked cluster used ChatGPT for C2 tooling in phishing of Seoul's diplomats. AI Threat Watch, case openai-dprk-korean-c2-phishing, Oct 7, 2025. https://aithreat.io/cases/openai-dprk-korean-c2-phishing/
Permanent link: https://aithreat.io/cases/openai-dprk-korean-c2-phishing/