AkiraBot Reportedly Used OpenAI to Spam Website Chats and Contact Forms at Scale

SentinelLabs reported that unknown operators used AkiraBot, a Python framework, plus OpenAI's chat API to generate customized SEO spam and bypass CAPTCHAs, posting via SMB websites' contact forms and Reamaze-style chat widgets. Researchers assessed >400k domains were targeted and ≥80k successfully spammed since 09/01/2024. OpenAI said the API key was disabled after disclosure.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The bot used AI to generate highly tailored spam messages to deceive specific website owners into purchasing dubious SEO services for the operators' personal gain.

Additional risk subdomains

• 1.2 Exposure to toxic content: The framework flooded tens of thousands of website contact forms and chat widgets with unsolicited spam, violating platform policies and community norms.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human threat actors who intentionally designed and deployed the [PERSON_001]Bot framework to abuse OpenAI's API for a large-scale spam campaign.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The AI system is used to generate synthetic text content (marketing messages) sent to users, which falls under the transparency obligations for AI-generated content where users should be informed they are interacting with or receiving AI-generated outputs.

AI system and alleged parties

• AI system: GPT-4o-mini mini (OpenAI)
• AI purpose: Writing Assistant; Chatbot
• Behaviour type: Tool
• Alleged developer: Unknown AkiraBot developers, OpenAI
• Alleged deployer: Unknown malicious actors, Unknown AkiraBot operators
• Alleged harmed parties: Wix sites, Victims of AkiraBot, SquareSpace sites, Small business owners, Shopify sites, Medium-sized business owners, GoDaddy sites, Customers, Business website users, Business owners

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Minor
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Epistemic

Reported: The report explicitly describes epistemic harm through the generation of misleading marketing messages and potentially fake Trustpilot reviews.

Directly caused: The bot generated customized outreach messages that falsely presented the sender as a legitimate marketer interested in the target website's specific content.

Indirectly caused: The campaign likely involved generating fake 5-star reviews on Trustpilot to make the dubious SEO services appear legitimate.

People affected

• Occurrences reported: 1
• People reportedly harmed: 80000
• People reportedly exposed: 420000

Potential causes

Management

• Lack of Proactive Key Detection: OpenAI relied on third-party security reports to identify API abuse.

Technology

• Abuse of GPT-4o-mini API: Threat actors abused OpenAI API to generate unique spam at scale.
• Hardcoded API Keys: Hardcoded keys allowed unauthorized, continuous access to LLM services.
• Unique Content Generation: LLM-generated unique text bypassed traditional static spam filters.

Data Inputs

• Scraped Website Content: BeautifulSoup scraped site text to feed custom context to the LLM.
• Generic Spam Templates: Templates structured the LLM prompts to output tailored marketing spam.

Human Factors

• Malicious Operator Intent: Threat actors intentionally bypassed protections to distribute spam.

Process and Methods

• Automated Prompt Engineering: Prompt instructed the LLM to act as a helpful marketing assistant.
• Concurrent Thread Execution: GUI allowed concurrent, automated targeting of thousands of websites.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from SentinelOne and other cybersecurity outlets provide highly detailed technical breakdowns of the [PERSON_001]Bot framework, including its source code, API prompts, target metrics, and the specific AI model used (GPT-4o-mini). The facts are consistent across all sources, and OpenAI's response confirming the abuse and disabling of the API keys provides strong validation.
• Ambiguities identified: None of significance. The role of the AI and the mechanics of the spam campaign are clearly documented.
• Alternative interpretations: None. The evidence clearly points to a coordinated, financially motivated spam campaign leveraging LLMs to bypass filters.

The [PERSON_001]Bot incident represents an evolved capability in automated spam operations, leveraging GPT-4o-mini to generate context-aware messages that bypass traditional security filters. While it successfully targeted over 80,000 websites, its national security impact remains negligible to minor, as the campaign was purely commercial and did not target critical systems or state functions.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The active campaign was mitigated by disabling API keys, but the underlying methodology represents an ongoing strategic capability concern for automated abuse.
• Autonomy: Full autonomy. The Python framework scraped websites, queried the AI, bypassed CAPTCHAs, and sent messages automatically without real-time human intervention.
• Novelty: Evolved capability. Represents an evolved capability where attackers combine web scraping with LLMs to dynamically bypass traditional signature-based spam filters at scale.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety elements were targeted or affected by this commercial spam operation.
• Information security: Negligible. The incident involved commercial spam promoting SEO services rather than state-sponsored disinformation, intelligence compromise, or political influence operations.
• Sovereignty: Negligible. No state authority, electoral systems, or core government operations were targeted or disrupted by this activity.
• Economic security: Minor. Minor operational disruption to over 80,000 small and medium-sized businesses receiving spam, demonstrating low-level economic nuisance but no strategic threat.
• Societal stability: Negligible. No threats to civil liberties, social cohesion, or human rights were observed; the activity was limited to automated commercial outreach.