Over 100,000 ChatGPT credentials leaked on Dark Web.

OpenAI’s Chatbot ChatGPT has been targeted by one of the most common forms of cyber attacks, resulting in the leak of over 100,000 login credentials. According to a report by Singapore-based cybersecurity firm Group-IB, the login credentials were gradually leaked over the past year.

Global-IB’s Report Reveals Compromised ChatGPT Login Credentials

Global-IB discovered 101,134 devices with saved ChatGPT credentials on the dark web, according to the report released on June 20th. Credential theft began in June 2022 and peaked at 26,802 in May 2023. Additionally, the data was traded on illicit dark web platforms between June 2022 and May 2023. Following its findings, the cybersecurity firm discovered that most of the ChatGPT credentials being offered for sale are from the Asia-Pacific region. Over the past year, around 40.5% of ChatGPT accounts that were stolen by info stealers came from the region. The Middle East and Africa, Europe, Latin America, and North America followed Asia-Pacific, respectively.

ChatGPT, which has become a popular technology tool since its announcement in November 2022, stores users’ queries and AI responses. Therefore, unauthorized access to the account could lead to the exposure of confidential information. Hackers often target these sensitive data and can exploit them to launch attacks against companies and their employees. Group-IB noted that info stealers had used their simplicity and effectiveness to become major sources of compromised personal data.

Most notably, Group IB’s analysis showed that most of the stolen ChatGPT login credentials were obtained through the notorious information-stealing malware Raccoon info stealer. The malware infiltrates victims’ computers via a phishing email and collects saved credentials from browsers, cookies, bank card details, and even crypto wallet details. Blockchain analytics firm Chainalysis revealed that over $3 billion in crypto was stolen last year.

• LDK Node Library simplifies self-custodial Lightning nodes for mobile apps.
• BitGo cancels Prime Trust acquisition, uncertainty returns.
• BitGo cancels Prime Trust acquisition.

ChatGPT’s Users Exposed

Furthermore, the cybersecurity leader highlighted the top 10 countries by the number of compromised ChatGPT credentials. India took the top position, followed by Pakistan and Brazil. Others are Vietnam, Egypt, the United States, France, Morocco, Indonesia, and Bangladesh. Dmitry Shestakov, the Head of Threat Intelligence at Group-IB, wrote:

“Many enterprises are integrating ChatGPT into their operational flow. Employees enter classified correspondences or use the bot to optimize proprietary code. Given that ChatGPT’s standard configuration retains all conversations, this could inadvertently offer a trove of sensitive intelligence to threat actors if they obtain account credentials. At Group-IB, we are continuously monitoring underground communities to promptly identify such accounts.”

The cybersecurity firm advises ChatGPT users in the report to regularly update their passwords to protect their credentials. It also recommends using two-factor authentication as an additional security measure to safeguard their ChatGPT accounts.