Social engineering.

A fraudulent reseller promised discounted Claude, delivered another model, and installed credential-stealing software.

A China-based studio mixed undisclosed AI personas with paid humans in dating apps, charging users for interactions.

Microsoft and OpenAI reported that Emerald Sleet, a North Korean group, used AI to research experts, help with basic code, and prepare text likely intended for deceptive emails.

SweetSpecter sent fake support emails to OpenAI staff. OpenAI later linked the campaign’s infrastructure to ChatGPT accounts seeking technical help.

An AI agent proposed harmful code and used fake identities to push for approval during a UK government test.

CERT-UA found malware in deceptive government emails. It asked AI to generate instructions for collecting documents.

Microsoft found ChatGPT-themed emails leading to payment-data collection forms.

Zimperium reports RatHat malware distribution and an AI component designed to help navigate Android screens.

Microsoft reports EvilTokens using AI to tailor phishing messages and identify valuable targets inside compromised email accounts.

Island observed deceptive Custom GPT replies directing people toward a Windows malware lure.

OX Security found two connected browser extensions sending ChatGPT and DeepSeek conversations to outsiders.

Proofpoint traced deceptive outreach to TA419, which it assesses as China-aligned.

Huntress traced two infections to deceptive Custom GPTs—user-made ChatGPT assistants.

Huntress found a deceptive Claude-hosted page delivering malware to at least 29 organizations.

Huntress traced a Mac infection to a deceptive shared Claude conversation.

Huntress traced a Mac data theft to instructions in an attacker-created ChatGPT conversation.

Cato found advertisements and fake Codex pages distributing Mac malware.

Barracuda reports phishing with hidden instructions for email assistants.