Iranian Hackers Are Weaponising ChatGPT and Gemini for Cyberattacks on the US and Israel: Report

Why It Matters

AI‑driven cyber attacks lower the barrier for sophisticated intrusion, amplifying geopolitical risk for critical infrastructure in the U.S. and Israel. The development forces defenders to rethink detection and attribution strategies in an era of automated threat generation.

Key Takeaways

• Iranian actors employ ChatGPT to auto‑generate phishing in Hebrew and Arabic
• Gemini model used to craft convincing fake identities for weeks‑long social engineering
• AI accelerates vulnerability scanning, shrinking attack planning cycles to days
• OpenAI and Google now actively disabling accounts linked to malicious activity
• U.S. also uses AI tools like Claude and Maven for its own intelligence operations

Pulse Analysis

The convergence of generative AI and cyber espionage marks a turning point in digital warfare. While AI models were originally marketed for productivity and creativity, threat actors have discovered that the same language‑generation capabilities can be repurposed to draft convincing spear‑phishing emails, translate malicious payloads, and even script code snippets on demand. This automation erodes the traditional skill gap, enabling relatively unsophisticated operators to launch campaigns that previously required seasoned developers and linguists. As AI models become more powerful and accessible, the volume of AI‑assisted attacks is expected to rise sharply, stretching the resources of security teams worldwide.

In the Iranian context, the adoption of ChatGPT and Gemini reflects a strategic pivot toward leveraging off‑the‑shelf technology to offset sanctions‑induced limitations. By feeding tailored prompts, hackers can produce malware variants that evade signature‑based detection, generate culturally nuanced phishing content, and maintain persistent, believable personas across weeks of interaction. The result is a higher conversion rate for credential theft and deeper infiltration of defense contractors and government agencies. Moreover, the automated scanning of public-facing assets for exploitable flaws shortens the reconnaissance phase, allowing multiple targets to be compromised in parallel.

The broader implication for the cybersecurity ecosystem is a renewed urgency for AI governance and defensive AI. Vendors are scrambling to embed abuse‑prevention safeguards, while governments consider regulatory frameworks that balance innovation with national security. Defensive teams must adopt AI‑driven analytics to match the adversary's speed, employing machine‑learning models that can detect anomalous language patterns and rapid account creation. Ultimately, the weaponization of generative AI underscores the need for a coordinated, multi‑layered response that blends technology, policy, and human expertise.