Crimson Sandstorm used ChatGPT for research, scripting and phishing content

Confirmed

OpenAI and Microsoft both state the accounts were tied to this actor; activity was limited, non-novel assistance.

The Iran-affiliated group used ChatGPT for app and web scripting, likely spear-phishing content, and research on malware evasion.

“Crimson Sandstorm used our services for scripting support related to app and web development, generating content likely for spear-phishing campaigns, and researching common ways malware could evade detection.”OpenAI

Sources

Disrupting malicious uses of AI by state-affiliated threat actorsOpenAI · 14 Feb 2024 · primary source
Staying ahead of threat actors in the age of AIMicrosoft Security Blog · 14 Feb 2024 · primary source

Date: Feb 2024
Disclosed: 14 Feb 2024
Actor: Crimson Sandstorm (nation state), as attributed by OpenAI
Nexus: Iran
Targets: Government and defense-related targets (per source)
What the AI did: Malware dev, Phishing content, Evasion
Model: ChatGPT (OpenAI services)
Model family: OpenAI
Model basis: stated by vendor
Autonomy: assist
Outcome: OpenAI accounts disabled in coordination with Microsoft.