100,000 ChatGPT Account Credentials Stolen and Sold on the Dark Web, as Information Security Threats Grow Increasingly Serious

According to the latest report from an overseas information security analysis team, more than 100,000 ChatGPT account credentials have been found stolen by hackers and circulated on dark web markets between June 2022 and May 2023.

These account credentials were sold to potential black-market buyers, creating serious information security risks. India in particular became one of the most affected countries, with more than 12,632 publicly disclosed private credentials, showing the scale of losses suffered by ChatGPT users in the region.

• Account credentials are linked to infostealers
• Multiple countries affected
• Infostealers dedicated to ChatGPT accounts
• Trading of infostealers on dark web markets
• Potential risks of ChatGPT and recommendations
• Attack methods related to adult-only content
• Recommendations for protecting your own safety
• Results and Discussion

Account Credentials Are Linked to Infostealers

These account credentials sold by hacker groups were discovered from the logs of infostealers. An infostealer is a type of malware capable of stealing sensitive information from a victim’s browser, including passwords, cookies, credit cards, and more. In this incident, the credentials of ChatGPT accounts were stolen and placed in the logs of these infostealers, and then sold to potential black-market buyers. This highlights the importance and prevalence of infostealers in modern information security threats, and many internet users likely have no idea what is happening on their computers, because this is different from the previous methods of destroying computer systems or ransomware viruses.

Multiple Countries Affected

Besides India, other countries were also affected by this incident. The report lists several of the most severely affected countries, including Pakistan, Brazil, Vietnam, Egypt, the United States, France, Morocco, Indonesia, and Bangladesh. This shows that the scope of the incident spans multiple geographic regions and poses a threat to ChatGPT users worldwide.

Infostealers Dedicated to ChatGPT Accounts

In the analysis of this incident, most of the stolen ChatGPT accounts were compromised by the notorious Raccoon infostealer. Raccoon is a widely used infostealer known for its highly covert attack methods.

There are also several other infostealers used to steal ChatGPT accounts, including Vidar, RedLine, GuLoader, and others. The popularity of these stealers has caused information security threats to keep increasing, leaving users and enterprises facing greater risks. The use of such malware loaders enables attackers to execute malicious programs within legitimate operations, which increases their covertness and makes the threats harder to detect.

Trading of Infostealers on Dark Web Markets

The report points out that logs containing information on stolen ChatGPT accounts are actively traded on dark web markets. These logs contain not only account credentials but also additional information such as the list of domains found in the logs and the IP addresses of compromised hosts. These transactions are priced on a subscription model, greatly lowering the threshold for committing cybercrime while also providing attackers with a platform to launch follow-up attacks.

Potential Risks of ChatGPT and Recommendations

ChatGPT is widely used in business processes in many enterprises. Employees use ChatGPT for confidential communications or to optimize proprietary code. However, ChatGPT’s standard configuration retains all conversation content, and if hackers obtain account credentials, this may inadvertently provide a large amount of sensitive intelligence to threat actors. To mitigate this risk, users are advised to follow proper password hygiene practices and use two-factor authentication (2FA) to protect their accounts and prevent account takeover.

Further reading: Can You Use ChatGPT AI Just by Adding LINE or Installing an App? Beware of Personal Data Leaks and Being Recorded by Scam Groups

Attack Methods Related to Adult-Only Content

A recently discovered VBScript variant of the malware GuLoader uses adult-only content as bait to lure victims. Attackers typically trick victims into downloading a ZIP file by offering documents related to adult film actresses. Once the victim executes the file, the malicious program is triggered, leading to the installation and execution of the malware.

Recently, a large number of illegal Facebook fan pages have uploaded videos such as movie explanations and news stories, and you can see a large number of attackers leaving comments below to lure people into clicking fake movie download links or links that look like pornographic films, with the aim of installing malware on people’s computers and phones.

Recommendations for Protecting Your Own Safety

In view of these information security threats, users are advised to pay attention to the following to protect their own safety:

1. Use strong passwords: Choose strong and unique passwords, change them regularly, and avoid reusing the same password across different platforms.
2. Enable two-factor authentication (2FA): Set up 2FA to increase account security and prevent others from accessing your account simply by having the password.
3. Keep software updated: Regularly update operating systems, applications, and security software to ensure the system can defend against known security vulnerabilities.
4. Click links with caution: Avoid clicking links from unknown sources or suspicious links, especially when receiving emails or messages from untrusted sources, and when receiving links from unknown sources on Facebook or TikTok.
5. Educate users: Provide relevant information security training and education to help users identify and respond to various information security threats.

Results and Discussion

The incident of ChatGPT account credentials being sold on dark web markets reveals a large amount of personal data leakage, and its information…