Summary: Researchers from CyberArk, a cybersecurity firm, has reportedly created a new strand of polymorphic malware using OpenAI’s ChatGPT. The researchers stated that the malware could easily circumvent current detection methods with very little effort. They went on to explain that using the API version of ChatGPT versus the web version, they were able to bypass security filters that enabled them to create working malware. From there, they were able to leverage ChatGPT’s ability to create and continually mutate injectors, thereby creating a polymorphic program that is highly elusive and difficult to detect.

One of the many spectacular tricks ChatGPT has been able to pull off is writing highly advanced malware that contains no malicious code at all, according to CyberArk. “As we have seen, the use of ChatGPT’s API within malware can present significant challenges for security professionals,” the report said. “It’s important to remember, this is not just a hypothetical scenario but a very real concern.”

Why it matters: As AI makes our lives easier, it also makes the adversaries lives’ easier as well. Security researchers told The Register this text-generating tool is worrisome because it can be used to experiment with creating polymorphic malware, which can be used in ransomware attacks. It’s called polymorphic because it mutates to evade detection and identification by antivirus. Not only that but low-skill miscreants could use the OpenAI bot to generate trivial malware that manages to infect naive or poorly defended networks. It’s apparent that malware using ChatGPT is going to be the future, and this is just the beginning for security vendors to become aware of the dangers inherent in this emerging environment of AI.

Summary: Approximately 35,000 users have been notified by PayPal that their accounts have been breached, however PayPal itself wasn’t hacked. These accounts were compromised by adversaries using previously leaked credentials for users of PayPal. Credential stuffing are attacks where hackers attempt to access an account by trying out username and password pairs sourced from data leaks on various websites. Credential stuffing also leverages users who use the same username and password combinations across multiple sites. This creates a huge vulnerability for users as if their info was previously leaked from a different source, those credentials can now be used to access other sites which may include payment card data or other sensitive PII.

These types of attacks rely more heavily on users being educated about the dangers of recycling passwords, and not being proactive in ensuring each site has unique credentials. “During the two days [of the attack], hackers had access to account holders’ full names, dates of birth, postal addresses, social security numbers, and individual tax identification numbers,” Bleeping Computer reports. The tactics behind this attack were simple and user awareness is key to circumventing these types of attacks.

Why it matters: It’s important for users to be aware that data loss is not just a risk of major corporations; individuals are also targeted just as frequently. But as personal loss is significantly less than corporate losses, these attacks typically don’t make headlines. This is an issue that affects everyone, and simply ensuring username and password combinations are unique for each site makes it harder for adversaries to steal our hard-earned money and sensitive information. It’s also a good idea to use a trusted password manager or dark web monitoring service to alert users when their credentials have been leaked on the web.