Case openai-scopecreep-malwareAI-assisted malwareWorldwide
ScopeCreep: Russian-speaking actor built Windows malware with ChatGPT throwaway accounts
A Russian-speaking group used temporary ChatGPT accounts, one per code change, to build modular Windows malware with DLL sideloading, obfuscation, credential theft and Telegram alerts, spread via a trojanized game tool.
HighAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 9, 2025
- Location
- Worldwide
- Target
- Gamers downloading a trojanized gaming tool
- Severity
- High
- Triggered by
- ScopeCreep (Russian-speaking)
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
A Russian-speaking group used temporary ChatGPT accounts, one per code change, to build modular Windows malware with DLL sideloading, obfuscation, credential theft and Telegram alerts, spread via a trojanized game tool.
Impact: Working malware with stealthy C2; OpenAI said impact may have been mitigated by fast reporting.
Who triggered it
Actor: ScopeCreep (Russian-speaking)
Attribution: OpenAI named the operation ScopeCreep and assessed the operators as Russian-speaking.
Motive: Credential theft and financial gain
How it happened
Attack vector: Iterative malware development through disposable ChatGPT accounts; distribution via a trojanized gaming tool
Root cause: Account-per-request opsec defeated per-account abuse detection until behaviour clustering caught it
Timeline
- Security press reports the trojanized gaming tool and malware repository takedown
- OpenAI bans the accounts; partners take down the malicious code repository
Response
Accounts banned, repository removed by industry partners, indicators shared.
Current status: Contained
Sources (open in a new tab)
- OpenAI June 2025 report PDF cdn.openai.com
- Security Affairs coverage securityaffairs.com
- TechRadar coverage techradar.com
Cite this case
ScopeCreep: Russian-speaking actor built Windows malware with ChatGPT throwaway accounts. AI Threat Watch, case openai-scopecreep-malware, Jun 9, 2025. https://aithreat.io/cases/openai-scopecreep-malware/
Permanent link: https://aithreat.io/cases/openai-scopecreep-malware/