Full Report
An alleged job scam, led by “Aiden” from “OpenAI,” recruited workers in Bangladesh for months before disappearing overnight, according to FTC complaints obtained by WIRED.
Analysis Summary
# Incident Report: OpenAI Branding Cryptocurrency Investment Scam
## Executive Summary
A large-scale investment fraud, masquerading as a legitimate remote job opportunity affiliated with "OpenAI," targeted workers in Bangladesh. Victims were lured via Telegram and a fake ChatGPT-branded app to invest cryptocurrency into tasks, only for the operators of the scheme ("OpenAi-etc") to disappear with funds, estimated around $50,000 from one team alone, on August 29, 2024. The incident highlights a sophisticated social engineering attack leveraging brand recognition and organizational hierarchy to defraud low-wage workers actively seeking employment.
## Incident Details
- **Discovery Date:** August 29, 2024 (Date of operator disappearance/rug pull). Complaints were logged with the FTC prior to this date.
- **Incident Date:** Occurred over several months, culminating in the final loss on August 29, 2024.
- **Affected Organization:** Unnamed Bangladeshi workers (at least 11 formal complaints to FTC, potentially 6,000 impacted).
- **Sector:** Employment/Financial Services (Targeting job seekers).
- **Geography:** Bangladesh (Victims); Alleged registration/operations linked to US (Colorado/NYC) and hosted in China.
## Timeline of Events
### Initial Access
- **Date/Time:** Varied, some starting as early as June/July 2024.
- **Vector:** Luring job seekers via **Telegram** and a fake **ChatGPT-branded application**.
- **Details:** Victims were recruited under the guise of completing simple online tasks for "OpenAI" in exchange for daily profits based on initial crypto investment.
### Lateral Movement
- **Details:** Not applicable in the traditional sense. The attack focused on *vertical escalation of trust and investment*. Scammers cultivated trust over months, using mentors, hierarchical team structuring, and even displaying feigned charity (e.g., after a cyclone) to encourage victims to invest more and recruit others (brokers).
### Data Exfiltration/Impact
- **Details:** The perpetrators performed a "rug pull" on August 29, 2024, vanishing with all accumulated crypto investment funds. Estimated $50,000 was lost by one team hierarchy alone. Victims lost both capital and pre-agreed profits.
### Detection & Response
- **Detection:** Victims discovered the scam when the website, funds, and all associated contacts ("Aiden," mentors) disappeared overnight on August 29, 2024.
- **Response Actions:** Victims lodged complaints with the US Federal Trade Commission (FTC). OpenAI confirmed it is investigating the matter.
## Attack Methodology
- **Initial Access:** Social engineering via instant messaging (**Telegram**) combined with the deployment of fake applications leveraging high brand recognition (**OpenAI/ChatGPT**).
- **Persistence:** Long-term relationship building (months) through direct messaging, fostering trust using hierarchical structures, and leveraging victims' desire for stable income (potentially amplified by cultural norms regarding hierarchy).
- **Privilege Escalation:** Not applicable to the attacker; instead, they achieved *trust escalation* by consistently showing small profits initially, encouraging larger investments.
- **Defense Evasion:** Difficult to ascertain specific technical evasion, but operational evasion relied on mimicking legitimate business registrations (Colorado/NYC addresses, FinCEN registration) while hosting infrastructure in China.
- **Credential Access:** Not explicitly detailed, but the mechanism involved victims willingly transferring cryptocurrency to the scam platform's digital wallet.
- **Discovery:** Attackers monitored victims' activity through Telegram and the fraudulent platform.
- **Lateral Movement:** Recruiting other potential victims (150+ individuals recruited by one victim).
- **Collection:** Soliciting and accumulating cryptocurrency investments from low-wage workers.
- **Exfiltration:** Coordinated withdrawal/disappearance (rug pull) of all collected funds.
- **Impact:** Significant financial loss for vulnerable individuals seeking work.
## Impact Assessment
- **Financial:** Direct loss of invested crypto capital and profits for victims. One subgroup lost approximately $50,000.
- **Data Breach:** No indication of sensitive PII theft beyond transactional financial data related to the fake investment.
- **Operational:** Minimal operational impact on the legitimate OpenAI, but devastating personal economic crises for the affected Bangladeshi workers.
- **Reputational:** Temporary damage to public trust associated with the OpenAI brand name among the affected community.
## Indicators of Compromise
- **Network indicators:** Defunct domain name associated with OpenAi-etc, potentially hosted by a China-based web hosting company. Suspicious US business registrations (Colorado, NYC office at Empire State Building).
- **File indicators:** Fake "ChatGPT-branded app" used for initial onboarding.
- **Behavioral indicators:** Communication exclusively through **Telegram** for work-related matters; demand for cryptocurrency investment to start earning "profits"; complex recruitment hierarchy encouraging new members.
## Response Actions
- **Containment measures:** The scam operators shut down the fraudulent website and disappeared.
- **Eradication steps:** Victims filed complaints with the FTC. OpenAI stated it is investigating. Telegram reported monitoring the platform for such scams.
- **Recovery actions:** No immediate recovery actions specified; victims are reporting losses to authorities.
## Lessons Learned
- **Key takeaways:** Scammers effectively exploit widely recognized brand names (like OpenAI) to lower suspicion in social engineering attacks (pig butchering hybrid jobs scams). Vulnerability is heavily linked to the trust placed in perceived authority figures and brands.
- **What could have been done better:** Victims, despite seeking legitimate work, became complicit by trusting an unverified online investment scheme communicated solely via chat application.
## Recommendations
- **Prevention measures for similar incidents:**
1. Organizations with high brand recognition must actively monitor platforms like Telegram and public forums for the misuse of their trademarks in job or investment solicitations.
2. Workers in vulnerable economic positions must be educated about the risks associated with investment-linked job offers, especially those communicating entirely outside of official corporate channels.
3. Authorities should enhance cooperation to assist international victims of scams rooted by US-registered front companies.