North Korean hackers use ChatGPT to create deepfake military IDs in phishing attacks
Researchers discovered that a suspected North Korean state-sponsored hacking group called Kimsuky used ChatGPT to create deepfake military ID documents in phishing attacks targeting South Korean journalists, activists, and researchers. The attackers leveraged the AI-generated deepfakes to make their phishing emails appear more credible and trick recipients into opening malware-laden attachments.
What happened
A suspected North Korean state-sponsored hacking group called Kimsuky used ChatGPT to create a deepfake of a South Korean military identification card, according to research published in July by Genians, a South Korean cybersecurity firm.
The fake military ID was used in phishing emails to make attacks appear more credible. Instead of including a real image, the emails linked to malware capable of extracting data from recipients' devices.
Phishing targets included South Korean journalists, researchers, and human rights activists focused on North Korea. The emails were sent from addresses impersonating South Korean military addresses ending in .mli.kr.
Reported impact
The US Department of Homeland Security stated in a 2020 advisory that Kimsuky is most likely tasked by the North Korean regime with a global intelligence-gathering mission.
The incident represents a trend of attackers leveraging AI tools for attack planning, malware development, tool creation, and impersonation during hacking and espionage operations.
Index analysis
ChatGPT was used to craft a fake draft of a military identification document to create a realistic deepfake image intended to deceive targets in a social engineering attack.
This incident demonstrates how generative AI tools can be misused post-deployment to support sophisticated phishing and espionage operations by state-sponsored actors.
Governance controls
OpenAI said in February it had banned suspected North Korean accounts that had used ChatGPT to create fraudulent rΓ©sumΓ©s, cover letters, and social media posts.
OpenAI representatives did not immediately respond to requests for comment on the Genians findings.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.