A cybercriminal has recently released a malicious version of OpenAI’s ChatGPT, dubbed “WormGPT,” and has weaponized it to conduct a potent email phishing attack that has impacted thousands of victims. The cybersecurity firm SlashNext reported that WormGPT, based on EleutherAI’s 2021 GPTJ large language model, has been specifically designed for nefarious purposes. With features like unlimited character support, chat memory retention, and code formatting, WormGPT has been trained using datasets related to malware, making it ideal for malicious activities.
ChatGPT vs. WormGPT
In an interview with Decrypt, Halborn COO David Schwed emphasized the significant difference between ChatGPT and WormGPT. He explained, “The difference [from WormGPT] is ChatGPT has guardrails in place to protect against unlawful or nefarious use cases.” He further stated, “[WormGPT] doesn’t have those guardrails, so you can ask it to develop malware for you.”
Phishing attacks, particularly Business Email Compromise (BEC) attacks, have long been a prevalent cybersecurity threat. In BEC attacks, perpetrators masquerade as company executives or employees to deceive targets into sharing sensitive information or transferring money. With the advancement of generative AI, chatbots like ChatGPT and WormGPT are now capable of generating convincingly human-like emails, making fraudulent messages increasingly difficult to identify.
What businesses can do
Unfortunately, technologies like WormGPT are lowering the entry barrier for executing effective BEC attacks, empowering less skilled attackers and expanding the pool of potential cybercriminals. To safeguard against such threats, SlashNext recommends organizations adopt enhanced email verification, including auto-alerts for emails impersonating internal personnel and flagging keywords commonly associated with BEC-related emails, such as “urgent” or “wire transfer.”
As cybersecurity risks rise, businesses must strengthen their defenses. Regular employee training in identifying and reporting suspicious communications is crucial. Implementing enhanced email and data protection can also help safeguard against data breaches and phishing scams.
