Microsoft busts hacker gang that tricked AI into drawing inappropriate celebrity fakes

Microsoft said it had discovered hackers in the U.S. and overseas who were bypassing restrictions on generative AI tools, including OpenAI services in the Azure cloud, to create malicious content, including intimate images of celebrities and other sexually explicit content. The company said the hackers involved were from the U.S., Iran, the U.K., Hong Kong, and Vietnam.

Image source: Mika Baumeister / Unsplash

The report says that the attackers extracted user logins of generative AI services from open sources and used them for their own purposes. After gaining access to the AI ​​service, the hackers bypassed the restrictions set by the developers and sold access to the AI ​​services along with instructions on how to create malicious content.

Microsoft believes that all the identified hackers are members of a global cybercriminal network that the company calls Storm-2139. Two of them are located in Florida and Illinois, but the company is not disclosing their identities so as not to harm the criminal investigation. The software giant said it is preparing relevant requests to law enforcement agencies in the United States and several other countries.

Microsoft’s measures come amid the growing popularity of generative neural networks and concerns about how AI can be used to create fake images of public figures and ordinary citizens. Companies like Microsoft and OpenAI prohibit the generation of such content and limit their AI services accordingly. However, hackers still try to bypass these restrictions, and they often succeed.

«“We take the misuse of artificial intelligence very seriously and recognize the serious and long-term impact of image abuse on potential victims. Microsoft remains committed to protecting users by implementing robust AI security measures across platforms and protecting services from illegal and harmful content,” said Steven Masada, associate general counsel for Microsoft’s cybercrime group.

The announcement follows a lawsuit filed by Microsoft in December in the Eastern District of Virginia against 10 unidentified individuals in an attempt to gather more information about the hacker group and shut it down. The ruling allowed Microsoft to take control of one of the group’s main websites. That and the release of a series of court documents last month have sent fears through the hackers’ ranks that could reveal the identities of some of the group’s members.