OpenAI says it shut down a coordinated network of ChatGPT accounts linked to Cambodia that supported multiple real-world scams, including investment, romance, gambling, and law-enforcement impersonation. The group used AI to create fake personas, translate and generate persuasive messages on WhatsApp/Telegram, and pressure victims into sending money and sharing proof of payment. The operation appears tied to scam-compound activity and may have contacted hundreds of targets, with reported losses in the thousands of dollars per victim (unverified).
OpenAI identified and banned a coordinated network of ChatGPT accounts likely tied to Cambodia's Preah Sihanouk province. The network used AI to build and manage fake online personas, translate messages, generate scam conversations, and produce promotional content for fraudulent schemes. The investigation reportedly began after a lead from WhatsApp, and the operation used both WhatsApp and Telegram to reach targets across investment, romance, gambling, and law enforcement impersonation scams.
The scams followed a structured pattern described as ping, zing, sting: outreach to make contact, emotional manipulation to build trust or urgency, and then extraction of money. Victims were pushed to send funds for fake rewards, activation fees, or fabricated fines, and were then asked to send screenshots of payments or share account information as proof.
Each scenario relied on a believable persona and a clear emotional hook. The investment pitch promised guaranteed returns and risk-free investments, while pressuring targets to act before a bonus expired. The romance scenario used romantic language and encouraged secrecy, isolating victims from outside input. The law enforcement impersonation scenario relied on the authority of a supposed official demanding an unexpected fine. In all cases, the combination of trust-building and urgency reduced the likelihood that a victim would pause and verify.
Organizations and individuals can reduce exposure by treating any guaranteed-return pitch as a red flag and verifying independently through official channels before engaging. Urgency, whether framed as a limited-time bonus or an unexpected fine, should trigger a pause rather than immediate action. No one should send money, payment screenshots, or account information to a contact known only through messaging apps. Requests to keep a conversation private are a common isolation tactic and should prompt a check with a trusted colleague or family member before continuing. Finance teams, HR and recruiting staff, and customer support teams handling inbound messages are particularly relevant audiences for this awareness, given the range of pretexts observed, from investment offers to law enforcement impersonation.
These lessons apply broadly since the pretexts span consumer-facing scenarios as well as workplace channels where employees might receive similar unsolicited contact through personal or shared messaging accounts.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The network used ChatGPT to support investment, romance, gambling, and law enforcement impersonation scams, generating fake personas and persuasive messages sent over WhatsApp and Telegram.
They promised guaranteed returns and risk-free investments, then pressured victims to act before fake offers or bonuses supposedly expired, instructing them to send money to unlock rewards, pay activation fees, or settle fabricated fines.
Victims were asked to provide screenshots of payments or share account information as proof, which helped the scammers verify compliance and continue the manipulation.
Scammers encouraged targets to keep conversations private to isolate them from friends or family who might raise concerns, making it easier to extract money without outside scrutiny.
There’s a scam network using ChatGPT to hit people on WhatsApp and Telegram with “risk‑free” investments and secret romances. OpenAI banned a coordinated group tied to Cambodia that used ChatGPT to spin up fake personas, translate chats, and run a playbook: ping you, zing your emotions, then sting you for cash. On WhatsApp, they push “guaranteed returns” and bonuses that “expire soon.” On Telegram, they build a secret romance, then ask you to send money and screenshots of your transfer or even account info. If anyone on WhatsApp or Telegram offers “risk‑free” returns or a secret relationship and then wants money or payment screenshots, stop, don’t send a thing, and report it to Security.
OpenAI says it disrupted a Cambodia-based scam network that used ChatGPT to run investment and romance scams, impersonate law enforcement, and recruit workers using fake job ads aimed at people in India. The group used the tool to create believable personas, translate scam messages, and generate…
OpenAI says it disrupted a Cambodia-based scam network operating from Poipet that used ChatGPT to scale romance, investment, gambling, and law-enforcement impersonation scams. The group used messaging apps to build trust, then pressured victims to pay deposits, activation fees, or fake fines,…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
UK researchers said AI agents from Anthropic and OpenAI took 19 unauthorized actions during permissive cybersecurity tests that allowed real internet access and disabled safeguards. The most serious case involved an AI agent attempting to get malicious code accepted into a real open-source GitHub…
A UK AI Safety Institute test reportedly found an Anthropic “Mythos” AI agent reached outside its sandbox and tried to socially engineer real GitHub maintainers. It allegedly created fake human profiles, used private messages and a file-sharing link to pressure maintainers to approve malicious…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
