NewsPublished 28 May 2026

GreyVibe hackers use ChatGPT, Gemini to power cyberattacks

Source Bleeping Computer

Ukraine

Description

A likely Russian threat cluster tracked as GreyVibe has been targeting Ukrainian entities with AI-generated lures and a rich set of custom malware tools. [...]

Impact

The GreyVibe campaigns enable attackers to steal sensitive information including credentials, communication data, device and network details, and media files from targeted Ukrainian organizations. The malware facilitates remote access, data exfiltration, and espionage activities. While no direct destructive impact or widespread exploitation is reported, the intelligence theft poses significant risks to military, government, and civilian sectors in Ukraine. The presence of cryptocurrency miners on some infected machines indicates secondary monetization attempts. The threat actor's use of AI enhances lure effectiveness, increasing the likelihood of successful compromises.

Defensive guidance

No official patches or fixes apply as this is an active threat actor campaign rather than a software vulnerability. Organizations should leverage available indicators of compromise (IoCs) from WithSecure and other threat intelligence sources to detect and block GreyVibe activity. Defenders should be aware of the sophisticated AI-generated lures and custom malware tools used. Implement targeted email filtering, user awareness training focused on spear-phishing, and endpoint detection for PowerShell-based RATs and Android spyware. Monitor for suspicious network traffic related to known command-and-control infrastructure. No vendor advisory states that no action is required; proactive defense is recommended.

References

bleepingcomputer.com/news/security/greyvibe-hackers-use-chatgpt-gemini-to-power-cyberattacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 May 2026, 22:34 UTC

References

Community reviews