Soft2Secure

Cybercriminals are using ChatGPT to create new malware or ransomware

Check Point Researcher’s (CPR) are diving deep into ChatGPT to see how this AI tool is being used to write malware.

OpenAI released ChatGPT to the world at the end of November 2022. It’s a free natural language processing tool that can be used to generate human-sounding essays, emails, code, even things like poems, which have been generated using ChatGPT. And while OpenAI has clearly specified in their terms of service that using ChatGPT for generation of malware, defining this as ransomware, keyloggers, viruses or other software intended to impose some level of harm and of spam are banned on their platform. But that has not stopped some curious parties from using it for just that thing.

Now Check Point Researcher analyzed data from hacking forums showing that many users are already doing this, even with little knowledge of programming or development. Now, in one example, a user was able to use ChatGPT to create a Python-based infostealer, which searches for common file types and then uploads copies to an FTP-server. Java-based malware was created as well, harnessing PowerShell to download and run other malware.

Another user claimed that they were able to create their first script using ChatGPT ever, which could be used to encrypt and decrypt files. Not just Python and JavaScript either. Some users and researchers have been able to write fully automated workflows for attacks using convincing phishing emails.

But I have a question for y’all. Does this mean that ChatGPT is bad? I think no, definitely not. Any advanced technology could be used for both positive purposes as well as nefarious ones, including many information security tools and software. In each of these cases, the code generated is fairly rudimentary and it would require some adjustments to work efficiently. Defensive mechanisms for detecting malicious URLs or code have also been developed using ChatGPT.

Now since this is an AI tool, it could learn and create more advanced code over time. Though, watching these trends closely will be important to see how these changes and how this changes the threat landscape. No ratings yet.