Hackers Utilize WormGPT to Improve Phishing Attacks

Cybercriminals have found a potent weapon in the form of WormGPT, a generative AI tool designed explicitly for malicious activities. WormGPT has emerged as an alternative to the well-known AI model ChatGPT, empowering hackers to launch more sophisticated cyber attacks, particularly in Business Email Compromise (BEC).

WormGPT enables cybercriminals to automate the creation of highly convincing fake emails personalized to the recipient, significantly increasing the success rate of their attacks. Unlike ChatGPT, which attempts to refuse output for tasks that could be deemed malicious, WormGPT has no ethical boundaries or limitations.

The researchers at SlashNext recently accessed the infamous WormGPT tool through a prominent online forum known for its association with cybercrime. WormGPT, based on the GPT-J language model, offers a range of powerful features, including unlimited character support, chat memory retention, and code formatting capabilities. While the specific datasets used to train WormGPT remain confidential, it is believed to have been trained on diverse malware-related data sources.

Comprehensive testing conducted by the researchers revealed the worrying potential of WormGPT. In one experiment, WormGPT was instructed to generate an email aimed at coercing an unsuspecting account manager into paying a fraudulent invoice. WormGPT produced an email that was remarkably persuasive and believable, exposing the tool's potential for launching sophisticated phishing and BEC attacks.

The use of generative AI in BEC attacks offers distinct advantages to hackers. Emails generated by AI exhibit good grammar, reducing the likelihood of being flagged as suspicious. Additionally, the accessibility and user-friendly nature of generative AI allow for low-skilled cybercriminals to execute sophisticated BEC attacks.

Addressing this escalating threat requires a multi-faceted approach. Companies should prioritize BEC-specific training programs that educate employees on the evolving nature of these attacks, how AI augments them, and the tactics employed by attackers. Implementing stringent email verification processes, including systems that flag emails impersonating internal executives or vendors and messages containing specific keywords associated with BEC attacks, is essential to fortify defenses.