SMS phishing, also known as "smishing", is a growing threat that tricks users
into disclosing private information or clicking into URLs with malicious
content through fraudulent mobile text messages. In recent past, we have also
observed a rapid advancement of conversational generative AI chatbot services
(e.g., OpenAI's ChatGPT, Google's BARD), which are powered by pre-trained large
language models (LLMs). These AI chatbots certainly have a lot of utilities but
it is not systematically understood how they can play a role in creating
threats and attacks. In this paper, we propose AbuseGPT method to show how the
existing generative AI-based chatbot services can be exploited by attackers in
real world to create smishing texts and eventually lead to craftier smishing
campaigns. To the best of our knowledge, there is no pre-existing work that
evidently shows the impacts of these generative text-based models on creating
SMS phishing. Thus, we believe this study is the first of its kind to shed
light on this emerging cybersecurity threat. We have found strong empirical
evidences to show that attackers can exploit ethical standards in the existing
generative AI-based chatbot services by crafting prompt injection attacks to
create newer smishing campaigns. We also discuss some future research
directions and guidelines to protect the abuse of generative AI-based services
and safeguard users from smishing attacks.

本论文通过提出 AbuseGPT 方法展示了现有生成式人工智能聊天机器人服务如何被攻击者利用在现实世界中创建短信网络钓鱼文本，最终导致更加狡猾的短信网络钓鱼活动，并探讨了一些未来的研究方向和指导方针来保护生成式人工智能服务的滥用以及保护用户免受短信网络钓鱼攻击。