GhostGPT

GhostGPT is a malicious or uncensored large language model (LLM) marketed to cybercriminals as an offensive AI assistant without ethical guardrails or content filtering. The content describes it as one of several underground alternatives to WormGPT and FraudGPT, primarily distributed through Telegram channels and discussed alongside other criminal LLM brands such as DarkGPT, DarkestGPT, MalwareGPT, KawaiiGPT, Xanthorox, and BlackHatGPT.

Based on the provided reporting, GhostGPT emerged in the first half of 2024 as a tool specialized in malware development, and later reporting describes it as introduced in late 2024 and capable of generating realistic phishing templates within seconds. In January 2025, Abnormal Security documented GhostGPT as a Telegram-distributed malicious chatbot marketed for rapid exploit development, malware creation, and exploit code generation, with pricing cited at $50 per week. The content also states GhostGPT is marketed for offensive cyber operations including malware development and DDoS-related attack code generation.

Its described capabilities include generating phishing content, exploit code, and malware-related output, with positioning as a force multiplier for established cybercrime workflows rather than a fundamentally new attack class. The content does not provide technical indicators of compromise such as hashes, domains, or file artifacts specific to GhostGPT itself. No specific threat actor attribution is given beyond its sale and promotion in cybercriminal ecosystems and Telegram-based underground channels.