A China-aligned advanced persistent threat (APT) group is actively leveraging OpenAI’s ChatGPT platform to develop malware and craft sophisticated spear-phishing emails for its global campaigns.
Security firm Volexity tracks the actor as UTA0388 and has analyzed its operations since June 2025, concluding with high confidence that the group uses Large Language Models (LLMs) to automate and enhance its attacks against targets in North America, Asia, and Europe.
Volexity first detected UTA0388 conducting highly tailored spear-phishing campaigns that impersonated senior researchers from fabricated but legitimate-sounding organizations. The initial goal was to socially engineer targets into clicking links leading to malicious archives.
Over three months, the threat actor expanded its operations, sending emails in English, Chinese, Japanese, French, and German. UTA0388’s tactics evolved to include “rapport-building phishing,” where they first engage a target in a benign conversation before sending a malicious link.
GOVERSHELL Malware
The payload is delivered via a ZIP or RAR archive containing a legitimate executable and a malicious Dynamic Link Library (DLL).
When the user runs the executable, a technique called DLL search order hijacking is used to load the malicious payload, a backdoor Volexity has named GOVERSHELL.
Researchers have identified five distinct variants of GOVERSHELL, which provides attackers with remote command execution capabilities and uses scheduled tasks for persistence, indicating active and ongoing development.
The malware variants show significant rewrites in their communication protocols and capabilities, shifting from C++ to Golang and employing different encryption methods.
The assessment of LLM usage stems from an aggregation of evidence rather than a single data point, a finding later corroborated by an OpenAI report. A key indicator is the “hallucinations” and nonsensical details present in the phishing campaigns.
UTA0388’s emails often contained fabricated entities, such as the “Copenhagen Governance Institute,” and used fake phone numbers with suspicious sequential patterns. The group also exhibited a consistent lack of coherence.
For instance, a single email would sometimes contain three different personas across the sender name, email address, and signature block. Volexity observed emails sent to English-speaking targets with a Mandarin subject line and a German body, suggesting context-unaware automation.
The targeting itself showed signs of automation without human review, as phishing emails were sent to non-existent addresses like first.last@ scraped from public web pages.
In some cases, archives contained superfluous “Easter eggs,” including pornographic images and audio recordings of Buddhist chants, which serve no operational purpose and would likely be avoided by a human operator trying to remain undetected.
Volexity assesses with high confidence that UTA0388 operates in the interest of the Chinese state, based on its targeting profile focused on Asian geopolitical issues and technical artifacts, such as developer paths containing Simplified Chinese characters found within a GOVERSHELL sample.
The constant and non-iterative rewriting of the malware’s network stack further supports the hypothesis of LLM assistance in code generation.
While it is difficult to measure the ultimate success of these AI-powered campaigns, the ability to generate a high volume of tailored phishing content, even with its flaws, presents a significant threat.
The activity demonstrates how threat actors are integrating AI to scale their operations, create more convincing lures, and accelerate malware development.
The continued evolution of the GOVERSHELL backdoor suggests that UTA0388 remains an active and persistent threat, adapting its tradecraft for future campaigns.
OpenAI has implemented a ban on ChatGPT accounts that were linked to hackers from China and North Korea who were attempting to use the platform for the development of malware.
Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today
