OpenAI has identified and banned ChatGPT accounts involved in suspected deceptive employment campaigns. Threat actors utilized OpenAI's models to create materials for fraudulent applications for IT, software engineering, and other remote jobs globally. The activity is consistent with schemes attributed to North Korea (DPRK).

These campaigns mimicked earlier observed behaviors, employing AI at multiple stages of the employment process. Actors attempted automated resume generation and recruited individuals in Africa and North America to operate laptops on their behalf. Two distinct operator types were identified: core operators who automated resume creation and sought information on application management tools, and contractor operators who used ChatGPT for application tasks and payment inquiries.

The threat actors researched tools like Tailscale VPN and OBS Studio to circumvent security measures and maintain undetected remote presence. They also sought guidance on configuring laptops to appear domestically located, masking geolocation and evading endpoint security. OpenAI's detection of these campaigns enabled them to share insights with industry peers and authorities, enhancing collective threat detection and response capabilities.