Case openai-russian-rat-stealersAI-assisted malwareWorldwide
Russian-speaking criminals assembled RAT and credential stealers from ChatGPT snippets
OpenAI banned accounts tied to Russian-speaking criminal groups that requested small code pieces to build a remote-access trojan, credential stealers and evasion features, posting evidence of their work on Telegram.
MediumAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 7, 2025
- Location
- Worldwide
- Target
- Windows users targeted by the group's malware
- Severity
- Medium
- Triggered by
- Unknown Russian-speaking criminal group
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
OpenAI banned accounts tied to Russian-speaking criminal groups that requested small code pieces to build a remote-access trojan, credential stealers and evasion features, posting evidence of their work on Telegram.
Impact: Refined malware components; OpenAI said the model refused direct malicious requests.
Who triggered it
Actor: Unknown Russian-speaking criminal group
Attribution: OpenAI linked the accounts to Russian-speaking criminal communities via their Telegram channel.
Motive: Credential theft and financial gain
How it happened
Attack vector: Requests split into snippets to evade refusals, then assembled into malware
Root cause: Fragmented coding requests bypassed intent detection
Timeline
- Group posts evidence of its malware work in a Russian-language Telegram channel
- OpenAI publishes the case and bans the accounts
Response
Accounts banned; findings shared with partners.
Current status: Contained
Sources (open in a new tab)
- OpenAI case study openai.com
- OpenAI October 2025 report PDF cdn.openai.com
- vpnMentor coverage vpnmentor.com
Cite this case
Russian-speaking criminals assembled RAT and credential stealers from ChatGPT snippets. AI Threat Watch, case openai-russian-rat-stealers, Oct 7, 2025. https://aithreat.io/cases/openai-russian-rat-stealers/
Permanent link: https://aithreat.io/cases/openai-russian-rat-stealers/