SweetSpecter spear-phished OpenAI employees while using ChatGPT for recon
What they were trying to do
- 01
Conduct reconnaissance on targets to support intrusion operations
- 02
Obtain scripting and vulnerability research assistance
- 03
Simultaneously target OpenAI employees via spear-phishing to potentially access non-public OpenAI systems
How they did it
SweetSpecter used ChatGPT accounts for reconnaissance, scripting support, and vulnerability research while concurrently running a spear-phishing campaign directly against OpenAI staff — a dual-track operation combining LLM productivity support with direct targeting of the platform provider itself.
Example queries
Verbatim excerpts from the disclosure — only what the vendor actually published.
Not detailed in the disclosure
What they achieved
Concrete outputs obtained before platform disruption.
- before disruption
Reconnaissance, scripting, and vulnerability research support obtained via ChatGPT before account disruption
OpenAI disrupted the accounts, shared findings with industry partners, and flagged the concurrent spear-phishing campaign targeting OpenAI employees.
Full summary
PRC-aligned SweetSpecter (Cisco Talos overlap with TGR-STA-0043) used ChatGPT for reconnaissance, scripting support, and vulnerability research while concurrently conducting a spear-phishing campaign against OpenAI staff. OpenAI disrupted the accounts and shared findings with industry partners.
AI platforms involved
Related incidents (same country or vendor label)
- CN · China
GTG-1002: first publicly disclosed AI-orchestrated cyber espionage campaign (PRC state-sponsored)
2025-11-13Anthropic - CN · China
APT41 and 20+ PRC-affiliated clusters used Gemini for post-compromise scripting and EDR reverse engineering
2025-01-29Google (GTIG) - CN · China
Spamouflage Chinese influence operation used LLMs to draft posts
2024-05-30OpenAI - CN · China
Charcoal Typhoon used LLMs for tooling and social-engineering research
2024-02-14Microsoft + OpenAI - CN · China
Salmon Typhoon used LLMs for translation and intel-agency research
2024-02-14Microsoft + OpenAI
Source note: Every entry in this catalog is derived from a primary public disclosure by the named platform vendor. This entry cites OpenAI as the primary source. No private, speculative, or non-public claims are presented here.