Rick Osgood asked ChatGPT to build a phishing campaign for a pentest, and it delivered a gift-card survey email, variants with more urgency and deliberately broken English, and a Bootstrap landing page whose jQuery form posts the victim’s credentials to a /login endpoint.
No jailbreak required: he simply asked, one step at a time.
The model even “fixed” the broken English until told to put the mistakes back in.
Check Point Research went a step further: ChatGPT wrote a phishing email impersonating a hosting company plus the VBA macro for an Excel attachment, and Codex added a reverse shell, with only a content-policy warning in the way.
Lowering the bar for non-native-speaking phishers is exactly the kind of progress nobody asked for.
