North Korean hackers use ChatGPT to generate deepfake military IDs
North Korean state-sponsored hackers from the Kimsuky group used ChatGPT in July 2025 to generate deepfake South Korean military ID cards as part of a sophisticated phishing campaign targeting journalists, researchers and activists. The attackers bypassed ChatGPT's safeguards through prompt engineering to create convincing forgeries that were used to distribute malware designed to steal sensitive data.
What happened
On July 17, 2025, the Genians Security Center detected a spear-phishing attack attributed to the state-sponsored threat group Kimsuky impersonating a South Korean defense-related institution. Hackers bypassed ChatGPT's safeguards via prompt engineering to produce fake South Korean military identification cards that were attached to spear-phishing emails containing malware designed to extract sensitive data.
The emails targeted journalists, researchers and human rights activists with links and attachments designed to harvest personal and organizational data from their devices.
Reported impact
While the exact number of victims is unclear, the incident demonstrates how deepfake documents increase the credibility and impact of phishing attacks, risking personal, organisational, and national security.
Index analysis
The incident demonstrates how ChatGPT can be manipulated to produce convincing forgeries, escalating the sophistication of impersonation and phishing threats worldwide. North Korean cyber units like Kimsuky are known for evolving tactics to evade international sanctions and obtain intelligence.
Hackers were able to manipulate ChatGPT prompts to generate prohibited government ID imagery despite built-in restrictions.
Governance controls
The incident raises important questions about ChatGPT's governance and the resilience of its digital infrastructure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.