Loading story…
Researchers at Resecurity have uncovered DIG AI, a powerful and uncensored artificial intelligence tool hosted on the darknet, which is being actively used by cybercriminals to automate sophisticated cyberattacks, generate illicit content, and bypass the ethical safeguards present in mainstream AI models. The tool, first detected in late September 2025, has rapidly gained popularity among threat actors, particularly during the winter holiday season, and is promoted by a darknet actor known as "Pitch." DIG AI offers a suite of specialized models, including an unrestricted text/code generator and an image model for deepfakes, all accessible anonymously via the Tor network without registration requirements. Investigators demonstrated the tool's ability to generate obfuscated malicious code, such as JavaScript backdoors, highlighting its potential to lower the barrier for launching advanced attacks.
The emergence of DIG AI marks a significant escalation in the criminal use of artificial intelligence, raising concerns about the increased automation and sophistication of cyber threats. Security experts warn that the tool's capabilities could be leveraged to target major global events in 2026, such as the Winter Olympics and FIFA World Cup, and that its existence signals a broader trend toward the "criminalization of AI." The tool's promotion alongside other illicit goods on underground forums further underscores the convergence of AI and cybercrime, presenting new challenges for defenders and law enforcement agencies worldwide.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Cyber Security News reported Resecurity's findings that DIG AI enables cybercriminals to automate attacks, generate malicious code, create deepfakes, and bypass mainstream AI safety controls. The report described the tool as a major escalation in criminal AI use and a growing risk ahead of major events in 2026.
Security Affairs included the emergence of DIG AI among major late-2025 cybersecurity developments in its newsletter roundup. The report highlighted the tool as part of broader criminal and threat-actor activity observed during the period.
Resecurity researchers first detected the darknet-hosted AI tool DIG AI in late September 2025. The tool was promoted by a threat actor known as "Pitch" and offered uncensored AI capabilities for malicious use via Tor.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new uncensored AI assistant known as DIG AI has emerged on darknet forums, rapidly gaining popularity among cybercriminals and organized crime groups. Security researchers observed a significant increase in the use of DIG AI during Q4 2025, particularly over the Winter Holidays, coinciding with a global surge in illegal activity. DIG AI, along with other "dark LLMs" such as FraudGPT and WormGPT, enables threat actors to automate and scale malicious operations, including cybercrime, extremism, privacy violations, and the spread of misinformation. These tools are often jailbroken or custom-built large language models with safety restrictions removed, making them attractive for illicit purposes. DIG AI is accessible via the Tor network, making it difficult for law enforcement to detect and disrupt its use. The tool can generate instructions for a range of illegal activities, from explosive device manufacturing to the creation of child sexual abuse material (CSAM), including hyper-realistic synthetic content. The rise of such AI-powered tools presents new challenges for security professionals and legislators, especially with major global events like the 2026 Winter Olympics and FIFA World Cup on the horizon, as criminals may exploit these technologies to bypass content protection and scale their operations.
Jun 29, 2026
Cybercrime forums have sharply increased discussion and sales activity around malicious AI tools, with researchers reporting a **219% rise** in mentions of dark AI tools and tactics and a **52% increase** in references to jailbreaking mainstream platforms such as ChatGPT. These offerings include jailbroken versions of public generative AI services and customized tools built on open-source large language models, often sold as AI-as-a-Service to support phishing, business email compromise, deepfakes, fraud, vulnerability analysis, malware development, identity fraud, password attacks, credential stuffing, and DDoS operations. Reporting on the underground market says well-known brands such as **WormGPT** and **FraudGPT** are only the most visible examples of a broader ecosystem of rebranded, resold, and short-lived criminal services. Analysts say the main effect of these tools is not breakthrough offensive capability but the removal of safety guardrails, making it easier for lower-skilled actors to generate convincing scam content and some malicious code; the market has also shifted toward repurposed open-source uncensored models, while scams targeting criminals and a reported leak of nearly **19,000** WormGPT user accounts highlight instability and risk inside the ecosystem itself.
Jul 15, 2026
A growing underground market for AI-powered hacking tools is emerging on dark web forums, according to research from Palo Alto Networks' Unit 42. These tools, including commercialized versions like WormGPT and free models such as KawaiiGPT, are designed to assist cybercriminals with tasks such as vulnerability scanning, data encryption, and generating malicious code. The accessibility and user-friendly nature of these large language models (LLMs) are significantly lowering the technical barriers for cybercrime, enabling even unskilled individuals to create attack scripts and conduct cyberattacks using simple conversational prompts. While the technical sophistication of these "dark LLMs" remains limited, their primary impact is in democratizing cybercrime by empowering low-level hackers and script kiddies. The tools are particularly useful for generating grammatically correct phishing emails and basic malware, especially for users operating across language barriers. Despite initial fears of highly advanced AI-driven cyberattacks, current evidence suggests that these models are more effective at aiding petty criminals than enabling complex, autonomous cyber operations.
Jun 29, 2026