Ledger / 7 Oct 2025
UNK_DROPPITCH/UTA0388 operators used ChatGPT for phishing and tools
Confirmed
OpenAI ties accounts to public Proofpoint and Volexity reporting.
The operators used ChatGPT to write multilingual phishing content and debug tooling.
“especially crafting phishing content and debugging or modifying their tooling”OpenAI
Sources
- Disrupting malicious uses of AI: October 2025 (report PDF)OpenAI · 7 Oct 2025 · primary source
- Disclosed
- 7 Oct 2025
- Activity
- 2025
- Actor
- UNK_DROPPITCH / UTA0388 (nation state), as attributed by OpenAI
- Nexus
- China
- Targets
- Taiwan semiconductors, US academia and think tanks
- What the AI did
- Phishing content, Malware dev
- Model
- ChatGPT
- Model family
- OpenAI
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Accounts banned.