Loading story…
OpenAI said it disrupted a small network of ChatGPT accounts linked to an operation it calls “VAGue Focus,” which used AI to generate social media posts, draft biographies, and translate outreach tied to apparent intelligence-gathering and social-engineering activity. According to the company, the actors posed as journalists, analysts, and consulting professionals associated with Focus Lens News, BrightWave Media Europe, and Visionary Advisory Group, and used the accounts to support outreach related to U.S. economic and financial policy topics.
OpenAI reported that the operation used AI-generated content to build personas on X and to translate messages, including some outreach that offered payment for classified documents. Drawing on the broader challenge of measuring influence activity, the company assessed the public-facing influence component as low impact, citing little authentic engagement, while saying there was not enough evidence to determine whether the covert social-engineering effort succeeded.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
OpenAI reported that it banned a small network of ChatGPT accounts linked to an operation it named “VAGue Focus.” The accounts had used OpenAI models to generate social media content, translate outreach, and support apparent social-engineering and intelligence-collection activity.
OpenAI said the Focus Lens News X account remained dormant until mid-2024, when it became active again in a manner consistent with compromise and repurposing. The account was then used in the operation's apparent covert influence activity.
OpenAI reported that the X account later associated with Focus Lens News had originally been created under a different name, then was briefly active before going dormant. OpenAI said this history was consistent with a compromised and repurposed account.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI said two likely China-linked influence operations used ChatGPT to generate images and social media posts aimed at divisive U.S. debates over AI infrastructure and trade policy. The clusters, dubbed **"Data Center Bandwagon"** and **"Tech and Tariffs,"** produced English- and Chinese-language content that portrayed data center expansion as driving up electricity prices, straining power grids, consuming water, and harming the environment, while separate posts framed U.S. tariffs as a covert tool for controlling the global technology landscape. OpenAI said the operators likely originated in China, used VPNs, prompted ChatGPT in simplified Chinese, and posed as Americans on platforms including **X** and **YouTube**. OpenAI assessed that neither campaign achieved meaningful engagement and found no evidence the operators created the underlying controversies or materially shaped them, but the activity showed how AI tools can be used to amplify existing domestic disputes. The company also found the actors used ChatGPT for operational support, including editing work reports containing OPSEC details and discussing ways to exploit Facebook’s ecosystem and evade Meta’s coordinated inauthentic behavior detection. A separate analysis said the activity appeared tied to a private Chinese technology contractor serving provincial government clients, reflecting a deniable, scalable model aligned with broader Chinese propaganda patterns and strategic competition over U.S. AI and data center buildout.
Jul 31, 2026
OpenAI reported that a **ChatGPT account linked to Chinese law enforcement** used the model to review and edit internal write-ups on so-called **“cyber special operations,”** which OpenAI assessed as activity consistent with **covert influence operations and transnational repression** aimed at harassing and silencing critics of the Chinese Communist Party. The uploaded materials described a sustained, resource-intensive campaign involving **hundreds of staff**, **thousands of fake social-media accounts**, mass content generation, and tactics such as flooding platforms with fraudulent complaints against dissidents, forging documents, and in some cases **impersonating U.S. officials** to intimidate targets. OpenAI said the activity was tied to a single account, which it **banned**. OpenAI also described an attempted **smear/propaganda operation targeting Japanese Prime Minister Sanae Takaichi**, where the actor prompted ChatGPT for plans to amplify negative commentary on social media and to draft messages from fake accounts to pressure other Japanese politicians; when the model refused, the actor’s later prompts suggested the operation proceeded using other AI models. Separately, OpenAI attributed another cluster of accounts likely originating from mainland China that used ChatGPT to seek information on **U.S. persons, online forums, and federal building locations**, and to draft emails posing as a Hong Kong-based firm (*Nimbus Hub Consulting*), with OpenAI noting indicators such as VPN usage and prompts written in **Simplified Chinese**.
Jun 29, 2026
OpenAI reported multiple cases of **malicious use of ChatGPT and related API access** spanning financially motivated fraud and government-aligned information operations, including romance scams, fake legal services, coordinated influence campaigns, and a state-linked harassment effort. In one detailed case (“**Operation Date Bait**”), actors used ChatGPT accounts and an API customer to generate ad copy for a fake dating service, drive victims to *Telegram*, and run semi-automated “missions” that required escalating payments; OpenAI said it banned accounts involved and noted the group’s claimed revenues could not be independently verified. OpenAI also described model use for translation, persona development, and internal coordination (e.g., generating status reports and assigning targets projected payout values), and cited evidence such as repeated text patterns posted by multiple X accounts. Google’s Threat Intelligence Group (GTIG) separately assessed that **nation-state threat actors** are operationalizing LLMs (including *Gemini* and other tools) for reconnaissance, victim targeting, and generating culturally fluent, multi-turn “rapport-building” phishing lures. GTIG also observed abuse of generative AI services’ public sharing features to host deceptive content used in **ClickFix** campaigns, where victims are tricked into copying and pasting malicious commands into a terminal; the activity was first observed in early December 2025. The reporting highlights a converging trend: adversaries are using LLMs to scale and localize social engineering while shifting delivery mechanisms toward trusted AI platforms and shared content features to increase credibility and reach.
Jun 29, 2026