Earlier this week, a report revealed that cybercriminals recently gained access to thousands of OpenAI ChatGPT account credentials and have been selling them on the dark web.

How it happened

According to cybersecurity solutions provider Group-IB, since last June, over 101,100 ChatGPT accounts have been compromised and listed for sale on “illicit dark web marketplaces.” This is concerning, as AI tools are increasingly being used for work projects, and the breached accounts could potentially expose private or sensitive company information.

Dmitry Shestakov, head of threat intelligence at Group-IB shared:

“Many enterprises are integrating ChatGPT into their operational flow…. Employees enter classified correspondences or use the bot to optimize proprietary code. Given that ChatGPT’s standard configuration retains all conversations, this could inadvertently offer a trove of sensitive intelligence to threat actors if they obtain account credentials.” 

Based on the findings, cybercriminals were able to access the information by utilizing info stealer malware, a malware that is typically deployed via phishing campaigns in order to obtain “credentials saved in browsers, bank card details, crypto wallet information, cookies, browsing history, and other information… and then [send] all this data to the malware operator.”

The main countries that were affected include Bangladesh, Brazil, Egypt, France, India, Indonesia, Morocco, Pakistan, the U.S., and Vietnam. Although there is no way of knowing for certain whose ChatGPT queries have been compromised, Group-IB encourages anyone who may have been affected by the breach to update their passwords and enable two-factor authentication.

The post How cybercriminals stole over 100k ChatGPT credentials in the past year appeared first on OPUSfidelis.