Loading story…
A new uncensored AI assistant known as DIG AI has emerged on darknet forums, rapidly gaining popularity among cybercriminals and organized crime groups. Security researchers observed a significant increase in the use of DIG AI during Q4 2025, particularly over the Winter Holidays, coinciding with a global surge in illegal activity. DIG AI, along with other "dark LLMs" such as FraudGPT and WormGPT, enables threat actors to automate and scale malicious operations, including cybercrime, extremism, privacy violations, and the spread of misinformation. These tools are often jailbroken or custom-built large language models with safety restrictions removed, making them attractive for illicit purposes.
DIG AI is accessible via the Tor network, making it difficult for law enforcement to detect and disrupt its use. The tool can generate instructions for a range of illegal activities, from explosive device manufacturing to the creation of child sexual abuse material (CSAM), including hyper-realistic synthetic content. The rise of such AI-powered tools presents new challenges for security professionals and legislators, especially with major global events like the 2026 Winter Olympics and FIFA World Cup on the horizon, as criminals may exploit these technologies to bypass content protection and scale their operations.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
On December 18, 2025, Resecurity publicly warned that the spread of dark LLMs, jailbroken models, and emerging criminal AI infrastructure could dramatically escalate AI-enabled cyber threats in 2026. The warning highlighted expected risks around major global events and the growing challenge for law enforcement and defenders.
By December 2025, Resecurity documented DIG AI being actively promoted on dark web marketplaces and used to generate malware, fraud content, criminal guidance, and highly realistic synthetic CSAM. The reporting also noted that the platform bypassed standard AI safety and moderation controls and was based on ChatGPT Turbo.
In Q4 2025, Resecurity observed a significant increase in the use of DIG AI, an uncensored AI assistant accessible via the Tor network without registration. The tool was being adopted by cybercriminals, organized crime groups, and terrorists to support illicit activity at scale.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Resecurity have uncovered DIG AI, a powerful and uncensored artificial intelligence tool hosted on the darknet, which is being actively used by cybercriminals to automate sophisticated cyberattacks, generate illicit content, and bypass the ethical safeguards present in mainstream AI models. The tool, first detected in late September 2025, has rapidly gained popularity among threat actors, particularly during the winter holiday season, and is promoted by a darknet actor known as "Pitch." DIG AI offers a suite of specialized models, including an unrestricted text/code generator and an image model for deepfakes, all accessible anonymously via the Tor network without registration requirements. Investigators demonstrated the tool's ability to generate obfuscated malicious code, such as JavaScript backdoors, highlighting its potential to lower the barrier for launching advanced attacks. The emergence of DIG AI marks a significant escalation in the criminal use of artificial intelligence, raising concerns about the increased automation and sophistication of cyber threats. Security experts warn that the tool's capabilities could be leveraged to target major global events in 2026, such as the Winter Olympics and FIFA World Cup, and that its existence signals a broader trend toward the "criminalization of AI." The tool's promotion alongside other illicit goods on underground forums further underscores the convergence of AI and cybercrime, presenting new challenges for defenders and law enforcement agencies worldwide.
Jun 29, 2026
Cybercrime forums have sharply increased discussion and sales activity around malicious AI tools, with researchers reporting a **219% rise** in mentions of dark AI tools and tactics and a **52% increase** in references to jailbreaking mainstream platforms such as ChatGPT. These offerings include jailbroken versions of public generative AI services and customized tools built on open-source large language models, often sold as AI-as-a-Service to support phishing, business email compromise, deepfakes, fraud, vulnerability analysis, malware development, identity fraud, password attacks, credential stuffing, and DDoS operations. Reporting on the underground market says well-known brands such as **WormGPT** and **FraudGPT** are only the most visible examples of a broader ecosystem of rebranded, resold, and short-lived criminal services. Analysts say the main effect of these tools is not breakthrough offensive capability but the removal of safety guardrails, making it easier for lower-skilled actors to generate convincing scam content and some malicious code; the market has also shifted toward repurposed open-source uncensored models, while scams targeting criminals and a reported leak of nearly **19,000** WormGPT user accounts highlight instability and risk inside the ecosystem itself.
Jul 15, 2026
A growing underground market for AI-powered hacking tools is emerging on dark web forums, according to research from Palo Alto Networks' Unit 42. These tools, including commercialized versions like WormGPT and free models such as KawaiiGPT, are designed to assist cybercriminals with tasks such as vulnerability scanning, data encryption, and generating malicious code. The accessibility and user-friendly nature of these large language models (LLMs) are significantly lowering the technical barriers for cybercrime, enabling even unskilled individuals to create attack scripts and conduct cyberattacks using simple conversational prompts. While the technical sophistication of these "dark LLMs" remains limited, their primary impact is in democratizing cybercrime by empowering low-level hackers and script kiddies. The tools are particularly useful for generating grammatically correct phishing emails and basic malware, especially for users operating across language barriers. Despite initial fears of highly advanced AI-driven cyberattacks, current evidence suggests that these models are more effective at aiding petty criminals than enabling complex, autonomous cyber operations.
Jun 29, 2026