Cybercriminals are selling access to a new malicious generative AI chatbot called GhostGPT. The AI tool is designed to assist with malicious activities such as malware creation and phishing emails.
Researchers from Abnormal Security observed the cybercrime tool being sold through Telegram from the end of 2024.
They believe GhostGPT uses a wrapper to connect to a jailbroken version of ChatGPT or another open-source large language model (LLM), ensuring uncensored responses for customers.
The new tool follows the creation of the WormGPT AI Chatbot in 2023, designed specifically to assist threat actors with business email compromise (BEC) attacks.
Several other variants of these models have since emerged, including WolfGPT and EscapeGPT.
The researchers said the new GhostGPT chatbot has received thousands of views on online forums, demonstrating a growing interest among cybercriminals in leveraging AI tools for nefarious activities.
GhostGPT an Effective Cybercrime Tool
Abnormal Security highlighted that GhostGPT can help low-skilled cybercriminals undertake successful campaigns.
Access to the tool is easy and can be bought on messaging service Telegram. As it is available as a Telegram bot, there is no need to jailbreak ChatGPT or set up an open source model.
“Users can pay a fee, gain immediate access, and focus directly on executing their attacks,” the researchers explained.
The creators of GhostGPT also claim that user activity is not recorded, enabling customers to conceal their illegal activities.
GhostGPT is marketed for a range of activities, including coding, malware creation, exploit development and writing convincing emails for phishing and BEC scams.
The tool’s promotional material emphasizes its fast response time, enabling customers produce malicious content and gather information more efficiently.
To test GhostGPT’s efficacy, the researchers asked it to create a DocuSign phishing email. The chatbot was able to quickly produce a convincing template.
