AkiraBot spammed 80,000 websites using OpenAI API
AkiraBot, a Python framework active since September 2024, used OpenAI's GPT-4o-mini API to generate personalized spam messages and flood over 80,000 websites with fraudulent SEO service promotions. The bot evaded CAPTCHA filters and network detection through automated browsing tools and proxy services, causing economic and reputational harm to small and medium-sized businesses.
What happened
AkiraBot, a Python framework active since September 2024, used OpenAI's GPT-4o-mini API to generate tailored spam messages targeting website contact forms and chat widgets. The framework successfully spammed at least 80,000 unique domains and targeted over 420,000 unique domains, primarily targeting small and medium-sized businesses using Shopify, Wix, Squarespace, GoDaddy, and generic website contact forms.
The bot generated unique marketing messages promoting fake SEO services (Akira and ServiceWrap brands) by instructing OpenAI's chat API to act as a marketing message generator. To evade detection, AkiraBot used Selenium WebDriver to simulate legitimate user activity, employed CAPTCHA bypass services (Capsolver, FastCaptcha, NextCaptcha), and used proxy services (SmartProxy) to avoid network detection.
Reported impact
Over 80,000 websites were successfully spammed with AI-generated messages targeting site owners to purchase fraudulent SEO services. The messages were designed to be unique and difficult to filter, and were often indexed by search engines, amplifying their reach.
Index analysis
AkiraBot used hardcoded OpenAI API keys to access GPT-4o-mini at scale, demonstrating a vulnerability in API key management and abuse detection. The bot's operator dashboard allowed tracking of attack metrics, selection of target websites, and concurrent targeting parameters.
Governance controls
OpenAI disabled the API key used by AkiraBot and stated it was continuing to investigate and disable associated assets. OpenAI said in a statement: 'We take misuse seriously and are continually improving our systems to detect abuse.'
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.