OpenAI has banned accounts associated with suspected deceptive employment campaigns that used AI to develop materials for potentially fraudulent remote job applications. This activity was detailed in a June 2025 report from OpenAI Safety.
These threat actors used OpenAI's models to create materials supporting what may be fraudulent attempts to apply for IT, software engineering, and other remote jobs globally. While OpenAI cannot determine the exact locations or nationalities of the threat actors, their behaviors align with activity publicly attributed to IT worker schemes connected to North Korea (DPRK).
Key Points
- OpenAI banned ChatGPT accounts linked to suspected deceptive employment campaigns.
- Threat actors used OpenAI models to develop materials for potentially fraudulent remote job applications.
- Activity patterns were consistent with IT worker schemes connected to North Korea (DPRK).
- Some actors may have been contractors for DPRK-linked groups, operating hardware within the US.
- Core operators attempted to automate resume creation and sought information on managing job applications.
- Core operators used ChatGPT as a research tool for remote-work setups and to generate content for recruiting contractors.
- Threat actors researched tools like Tailscale peer-to-peer VPN, OBS Studio, vdo.ninja, and HDMI capture loops.
- Possible contractor operators used ChatGPT to complete job application tasks and inquire about payments.
Context
According to OpenAI, these campaigns represent an evolution from previous observations in February, where actors manually generated credible, often U.S.-based personas. The latest campaigns attempted some degree of automated resume generation. Indicators also suggest operators in Africa posing as job applicants, alongside recruitment of individuals in North America to run laptops on behalf of the core operators.
Why It Matters
This case highlights how AI models can be misused for social engineering and evasion tactics, prompting developers and users to consider the security implications of AI-generated content in sensitive processes like employment applications. It also underscores the importance of vigilance against sophisticated, AI-enhanced deceptive practices.
What To Do
- Note the specific tools and techniques researched by threat actors, such as Tailscale, OBS Studio, and HDMI capture loops, as potential indicators of compromise.
- Review the June 2025 report from OpenAI Safety for further details on the observed deceptive employment schemes.
- Watch for guidance from OpenAI and industry peers regarding enhanced detection and prevention strategies for AI-assisted social engineering.
- Consider how AI-generated content might be used in fraudulent applications when evaluating candidates or securing systems.