(Credit: Tada Images/Shutterstock.com)
OpenAI was targeted by Chinese cybercriminals who sent malware to OpenAI employees, according to an intelligence threat report the company published on Wednesday.
"We disrupted a suspected China-based threat actor known as 'SweetSpecter' that was unsuccessfully spear phishing OpenAI employees' personal and corporate email addresses," OpenAI says.
The SweetSpecter hackers are also using OpenAI's tools to conduct its operations, according to the company, which said it's banned an unspecified number of accounts it believes are tied to the group. The hackers are reportedly using OpenAI tools for things like "reconnaissance, vulnerability research, scripting support, anomaly detection evasion, and development."
The group previously targeted embassies, ministries, government officials, and other political entities, and aligns with Chinese government interests, according to US cybersecurity firm Palo Alto Networks.
Here's how the spear-phishing attack works: Hackers sent .zip files to OpenAI staff claiming to detail the sender's "problems," accompanied by a formal email about how they found "shortcomings" in ChatGPT. These emails, however, were blocked from reaching corporate inboxes by OpenAI's internal security systems.
If the zip file was downloaded, a document would appear listing supposed error messages from ChatGPT, when, in the background, "SugarGh0st RAT" Windows malware would assume control over the PC, allowing the hackers to swipe data and access the computer.
These attacks were unsucessful, however, according to OpenAI. They're also separate from a successful breach of an OpenAI Newsroom X account last month, where hackers used the account to promote a fake token drop that was actually a crypto phishing scam that would drain victims' wallets.
Phishing email scams are a real concern for both everyday consumers and employees at tech firms. Phishing attacks can lead to massive corporate data breaches or lost funds and can happen via email, phone, or text. Thankfully, learning about the most common techniques and types of attacks can protect you from falling for phishing scams.