What happened

Hackers from the Kimsuky group bypassed ChatGPT’s safeguards via prompt engineering to produce fake South Korean military identification cards that were attached to spear-phishing emails impersonating official defense institutions. 

Sent to journalists, researchers and human rights activists, the emails contained links and attachments with malware designed to extract sensitive data from devices. 

While the exact number of victims is unclear, the incident highlights how deepfake documents increase the credibility and impact of phishing attacks, risking personal, organisational, and national security. 

Why it happened

The hackers were able to manipulate ChatGPT prompts to generate prohibited government ID imagery, despite built-in restrictions. 

North Korean cyber units like Kimsuky are known for evolving tactics to evade international sanctions and obtain intelligence.