North Korean hackers use ChatGPT to steal information from international companies

OpenAI has blocked several ChatGPT accounts that were apparently used by North Koreans as part of a large-scale IT fraud scheme. The announcement is all the more alarming given that ChatGPT recently received video integration with Google Drive and Dropbox. Theoretically, it is possible to develop a scheme for unauthorized access to user data.

According to journalists, North Korean specialists posed as IT workers from the United States and other countries in order to get remote work at Western companies.

Such actions not only provide financial income to the DPRK budget, but are also used to access the internal systems of organizations, as happened in the case of KnowBe4. Fraudsters gained access to confidential information and could introduce malicious programs.

OpenAI’s investigation showed that ChatGPT was actively used at every stage of the fraudulent scheme: from writing cover letters and preparing resumes for specific vacancies to creating scripts to emulate activity on issued laptops. With the help of AI, the scammers also generated texts for setting up VPNs, coding, and communicating on behalf of American citizens.

One of the tasks solved using ChatGPT was the mass creation of resumes based on templates compiled on the basis of real vacancies and profiles. In addition, the scammers tried to attract US citizens to create so-called “laptop farms” – networks of devices issued by companies to IT specialists who supposedly work from America, but in fact – from the DPRK.

According to US intelligence agencies, in 2024 one such scheme was uncovered, in which a citizen of Ukraine participated. He helped to forge digital identities to hide the real origin of candidates.

Earlier in April, Google warned that such schemes had spread to Europe. There, North Korean IT specialists tried to get jobs at companies by posing as Ukrainians. Additionally, it was reported that Pyongyang had formed a separate hacking unit focused on using artificial intelligence for attacks and hacks.