--- title: "GreyVibe hackers use ChatGPT, Gemini to power cyberattacks" url: https://daily.dev/posts/greyvibe-hackers-use-chatgpt-gemini-to-power-cyberattacks-a0fslhn3f source_url: https://www.bleepingcomputer.com/news/security/greyvibe-hackers-use-chatgpt-gemini-to-power-cyberattacks type: article source: "BleepingComputer" published: 2026-05-28T22:26:51.230Z updated: 2026-05-30T00:17:48.501Z tags: ["llm", "malware"] reading_time: 4 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GreyVibe hackers use ChatGPT, Gemini to power cyberattacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 1 upvotes · 0 comments ## Summary WithSecure has uncovered a likely Russian threat cluster called GreyVibe that has been targeting Ukrainian military, government, and civilian organizations since at least August 2025. The group uses AI tools including ChatGPT, Google Gemini, and Ideogram AI to generate convincing phishing lures and develop custom malware. Attack chains include spear-phishing (PhantomMail), fake CAPTCHA pages (PhantomClick), fake adult dating sites delivering Android spyware (PrincessClub), fake military charity sites (DroneLink), and fake Russian military login pages (Nebo). Custom malware includes LegionRelay and PhantomRelay PowerShell RATs and FallSpy Android spyware. Researchers believe GreyVibe may involve former cybercriminals operating with state-directed tasking, based on links to ex-TrickBot members and atypical operational security practices. IoCs are publicly available via WithSecure's GitHub. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#llm](https://daily.dev/tags/llm), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/greyvibe-hackers-use-chatgpt-gemini-to-power-cyberattacks-a0fslhn3f)