ChatGPT serves as bait to apply a scam, says company – 03/28/2023 – Tech

The success of ChatGPT translates into its more than 100 million users in less than four months on the air. Cybercriminals, however, took advantage of this trend to apply fraud with the name of the chatbot based on artificial intelligence (AI), shows a study by security company Eset.

Scammers offer browser extensions that promise to facilitate access or expand ChatGPT functionality. While some of these features work, these programs steal data, such as access information to social media accounts.

An example of this practice pointed out by Eset is the “Quick Access to ChatGPT” program. The developer of this tool used frequent traffic jams on the chatbot’s website, which prevent users from accessing it, to promote this promise of a solution.

This extension delivers what it promises, but steals accounts on Facebook and other social networks. The extension was available for six days on the official Google Chrome store during February and recorded an average of 2,000 installations daily, until it was removed by the browser.

Also according to Eset, pages on Facebook promoted content about this tool and distributed links and ads that lead to sites that impersonate ChatGPT. Criminals also seek to trick victims into downloading malicious files onto their computers.

“It wouldn’t be strange if we found more malicious extensions in activity or that a new one appears soon. Be very careful with what you install in your browser”, says, in a note, Camilo Gutiérrez Amaya, head of Eset’s research laboratory.

Stolen information can also grant criminals access to bank accounts and payment platforms.

Cybercriminals also offer fake smartphone apps under the name ChatGPT to try to steal data. OpenAI, however, does not provide this service to users so far.

European law enforcement agency Europol warned this week that rapid advances in generative AI could help online fraudsters and cybercriminals, so “big dark language models could become an important criminal business model in the future”.

Cybersecurity firm Sophos, on the other hand, has been studying ways to use the technology behind ChatGPT, GPT-3, to detect fraud. The language model was used in tests to catalog malicious activity in spam banks and facilitate future risk identification.

Current security programs still generate noise with false alerts, according to Sophos threat researcher Sean Gallagher. “There are a lot of notifications and detections to sift through, and companies are dealing with limited resources.”

The most advanced GPT-3 model offered to the public, called Davinci, achieved 88% accuracy in identifying which spam messages are malicious. On the last day 14, OpenAI released the newest version of its artificial intelligence, the GPT-4, which delivers more accurate responses.

Any unwanted message can be characterized as spam. Those used to steal data are malicious, in a scam known as phishing – a reference to the verb to fish in English, since there is a bait.

Sophos researchers use a training technique based on small data samples called few-shot learning. This reduces the need to collect large amounts of data.

Models are then improved in a process of trial and error as they have more access to data, called repeat learning.