APT Hackers Abuse ChatGPT to Develop Advanced Malware and Phishing Campaigns

Security researchers at Volexity have uncovered compelling evidence that China-aligned threat actors are leveraging artificial intelligence platforms like ChatGPT to enhance their sophisticated cyberattack capabilities.

The group, tracked as UTA0388, has been conducting sophisticated spear phishing campaigns since June 2025, using AI assistance to develop malware and craft multilingual phishing emails targeting organizations across North America, Asia, and Europe.

AI-Enhanced Phishing Operations Target Global Organizations

UTA0388’s campaigns demonstrate unprecedented sophistication in their use of Large Language Models to automate and enhance malicious activities.

The threat actors created fabricated personas and fictional research organizations to socially engineer targets into downloading malicious payloads.

What sets these campaigns apart is the sheer volume and linguistic diversity of attacks, with emails crafted in English, Chinese, Japanese, French, and German.

Volexity observed over 50 unique phishing emails that appeared fluent and natural-sounding across multiple languages, an unusual capability for traditional threat actors who typically rely on limited linguistic skills.

However, despite the linguistic fluency, the emails consistently lacked coherence, containing nonsensical combinations such as English-speaking targets receiving emails with Mandarin subject lines and German message bodies.

The threat actors employed “rapport-building phishing,” where initial contact appeared benign, only delivering malicious content after targets engaged in conversation over multiple email exchanges.

This approach minimizes infrastructure exposure while building trust with potential victims before deploying malicious payloads.

GOVERSHELL Malware

Technical analysis reveals five distinct variants of UTA0388’s custom malware, dubbed GOVERSHELL, each representing significant rewrites rather than iterative improvements typical of human development patterns.

This unusual development approach suggests potential AI assistance in rapidly generating different communication methods and capabilities across malware iterations.

GOVERSHELL variants employed various command-and-control mechanisms, from fake TLS communications to WebSocket connections, with each iteration introducing new features and completely rewritten network stacks.

The malware achieves persistence through scheduled tasks and uses search order hijacking techniques to load malicious DLL files alongside legitimate executables.

Particularly telling are technical artifacts discovered in malware samples, including developer paths containing Simplified Chinese characters and metadata indicating creation using python-docx, a Python library commonly used by LLMs for document generation tasks.

The assessment gained significant validation when OpenAI published a comprehensive report in October 2025 confirming that UTA0388 had indeed leveraged their ChatGPT platform for spear phishing and malware development operations.

Evidence of AI usage includes fabricated organizational details with predictable sequential patterns, bizarre “Easter eggs” in malware archives including pornographic content and Buddhist religious recordings, and systematic targeting of obviously fake email addresses scraped from websites without proper contextual awareness.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.