Forcepoint Solutions Architect Aaron Mulgrew detailed how a novice (himself) was able to create advanced malware using only prompts from the ChatGPT language model, without writing any code. Mulgrew implemented advanced techniques, like steganography, to evade detection and create a fully functional end-to-end malware that could exfiltrate sensitive documents.
The purpose of this exercise was to prove how easy it is to create advanced malware using ChatGPT and to evade its guardrails.
Mulgrew used Go implementation language and generated small snippets of helper code to manually put the entire executable together. The malware was intended for specific high-value individuals, where it could search for high-value documents on the C drive, rather than risk bringing an external file on the device and being flagged for calling out to URLs.
Mulgrew combined the snippets to create an MVP and tested it against modern attacks like Emotet. It was optimized to evade detection by refactoring the code, adding delays, and obfuscating the code.
Mulgrew tested the MVP against two industry-leading behavioral monitoring endpoint tools and was able to successfully exfiltrate data to Google Drive. Mulgrew added an initial infiltration mechanism by embedding the executable into a screen saver format on Windows and uploaded the results to VirusTotal. Mitigations to protect against this attack include monitoring network traffic, blocking suspicious traffic, implementing access controls, using encryption, training employees, and regularly updating and patching software. ChatGPT can be used for malicious code development by generating human-like text in response to prompts, making it a useful tool for various natural language processing tasks, including writing code. With its powerful AI capabilities, a novice user can generate advanced malware without writing any code, and even evade detection by security tools. By using techniques like steganography and "living off the land," an attacker can create malware that silently exfiltrates sensitive data to an external server. While the use of ChatGPT for malicious purposes is unethical and illegal, it is concerning that such a powerful tool can be misused in this way.
###