underground_llm_account_sellers

Underground LLM account sellers are cybercriminal actors operating in underground markets who sell or rent access to AI and large language model accounts, including ChatGPT, Perplexity, and Gemini subscriptions. Observed activity includes renting shared ChatGPT Plus access, with one ad offering one-month access for $6.99, three months for $14.99, six months for $24.99, and one year for $34.99. Supporting reporting describes both shared and private access models for ChatGPT Plus and Pro accounts, as well as discounted Perplexity Pro subscriptions and stolen credentials sold on criminal markets. Their activity relies on compromised or fraudulently obtained accounts, including subscriptions purchased with stolen credit cards and credentials harvested through infostealer malware logs. Available reporting also notes the sale of stealer logs containing LLM account credentials, stolen session cookies that can bypass MFA by hijacking active sessions, and lists of free OpenAI credentials posted on underground forums. These accounts are resold for profit and can be used by buyers for phishing, malware development, social engineering, reconnaissance, data theft, and other cybercriminal operations. No specific nation-state attribution is provided for this actor grouping. The only known alias directly provided in the content is underground_llm_account_sellers.