When it comes to online scams, ‘ChatGPT is the new crypto’

Digital fraudsters are as enamored with ChatGPT as everyone else on the internet and have taken advantage its allure to spread a new strain of malware across Facebook, Instagram and WhatsApp in recent months.

Since March, Meta has blocked more than 1,000 unique ChatGPT-themed web addresses designed to deliver malicious software to users’ devices, the company revealed Wednesday in a report on security issues across the company three major platforms.

“As an industry we’ve seen this across other topics that are popular in their time, such as crypto scams fueled by the immense interest in digital currency,” Guy Rosen, Meta’s chief information security officer, told reporters ahead of the report’s release. “So from a bad actor’s perspective, ChatGPT is the new crypto.”

Indeed, hackers are using the skyrocketing interest in artificial intelligence chatbots such as ChatGPT to convince people to click on phishing emails, to register malicious domains that contain ChatGPT information and develop bogus apps that resemble the generative AI software. At Meta, the company’s security team has observed around 10 malware families using ChatGPT and other generative AI-related themes to lure victims into installing malware on their systems, Meta researchers Duc H. Nguyen and Ryan Victory said in a blog posted to the company’s site.

The malware used in these cases are part of attackers’ efforts to take control of business account pages and accounts in order to run unauthorized ads, the company said, which can then lead to further malicious activity. Along with identifying a new strain of malware dubbed “NodeStealer,” the company also said it is launching a support tool that guides users through a step-by-step process to identify and remove malware.

Hackers have created malicious browser extensions hosted on the official browser web stores claiming to offer ChatGPT-related tools, Rosen said, noting that some of the malicious tools did include working ChatGPT functionality alongside the malicious code.

Meta’s security researchers have not yet seen generative AI used to craft the attacks, or as the interaction point with victims, rather than as a general lure to attract victims, said Nathaniel Gleicher, the company’s head of security policy. Meta is thinking through how AI could be abused in that way, he added, “but it’s very early in the development of these tools.”

The malware was also observed across a range of platforms, including the major file-sharing companies such as Dropbox, Google Drive, Mega and others, with the ultimate goal of compromising businesses with access to ad accounts across the internet, the researchers said. Rosen said Meta shared information about the malicious tools with the platforms involved.

Meta researchers working this issue also identified a new malware strain they dubbed “NodeStealer” in late January 2023 that targeted internet browsers on Windows systems with the goal of stealing cookies and saved usernames and passwords to ultimately compromise Facebook, Gmail and Outlook accounts, the researchers said. Analysis of the malware determined that it likely originated in Vietnam, they added.

The malware was discovered within two weeks of it being deployed, and counter actions against the operation — including takedown requests to third-party registrars, hosting providers and others — “led to a successful disruption of the malware,” the researchers added, noting that they have not seen new samples from the NodeStealer family since February 27 of this year.

In October, Meta shared information on more than 400 malicious Android and iOS apps that targeted users for their Facebook login information. Those apps indiscriminately targeted the general public but Wednesday’s revelations are different, Gleicher said, calling it “aggressive and persistent malware campaigns that target businesses.”

Business-account attacks typically start with attackers going after the personal accounts of people who manage or are connected to the business pages or advertising accounts, the company said. In response, the company is updating its approach to the problem with the malware removal support, and also changes to how business pages are managed, such as by giving administrators the power to better limit who has access to key functions and expanded authorization requirements for sensitive actions such as accessing credit lines.

Later this year, the company is planning later to roll out Meta Work accounts to allow business users to log in and operate pages without requiring a personal account as part of an effort to keep business accounts secure even if a personal account has been compromised.

Also on Wednesday, Meta released its quarterly adversarial threat report, which details the company’s fight against cyberespionage and coordinated inauthentic behavior networks. In the first quarter of 2023, the company removed three cyberespionage networks: one from a state-aligned threat group in Pakistan, a mercenary cyber operation known as Bahamut, and a pro-Indian hacking group known as Patchwork.

Meta also removed a flurry of inauthentic behavior networks linked to China, Iran, Toto and Burkina Faso, Georgia, and another based in Venezuela and the U.S.

The cross Venezuelan/U.S. operation included 24 Facebook accounts, 54 pages and four Instagram accounts, the company said, but also included activity on Twitter, Medium and websites posing as news organizations. The operation targeted Guatemala and Honduras, according to Meta, but had little to no engagement from authentic communities on the company’s services.