Loading story…
Threat actors are using large language models to mass-produce phishing and scam websites, particularly in cryptocurrency-themed fraud campaigns impersonating brands including Crypto.com, MetaMask, Coinbase, Ledger, KuCoin, and Gemini. The automated content lowers the effort required to create large volumes of convincing, unique text and is appearing on common hosting platforms such as GitBook, Webflow, and GitHub Pages, making fraudulent pages faster to deploy and harder to catch with traditional phrase-matching defenses.
Researchers found that many of the fake pages still reveal their origin through telltale AI artifacts, including apology or refusal language, knowledge-cutoff references, stereotyped wording, truncated outputs, and accidental inclusion of model-generated meta text. Those mistakes currently give defenders useful detection opportunities, but the report warns that as LLM-generated scam content improves, security teams will need to rely more on metadata, page structure, and machine-learning-based detection rather than simple keyword rules.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published an analysis describing how threat actors use large language models to generate phishing, scam, and fake-brand websites at scale, especially in cryptocurrency-themed fraud. The report highlighted detectable artifacts such as apology/refusal phrases, knowledge-cutoff statements, stereotypical wording, and accidental inclusion of model-generated meta text.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported escalating **criminal abuse of large language model (LLM) infrastructure**, including active exploitation of exposed or weakly authenticated AI service endpoints. Pillar Security documented more than **35,000 attack sessions** over ~40 days against honeypots and attributed the activity to an operation dubbed **“Bizarre Bazaar,”** described as an early example of actor-attributed “**LLMjacking**.” The activity targeted misconfigured/self-hosted deployments and AI APIs (including **unauthenticated Ollama endpoints on `11434`** and **OpenAI-compatible APIs on `8000`**), with attackers moving quickly once endpoints appeared in internet-wide scanners such as Shodan/Censys. Reported objectives included **stealing compute** (e.g., crypto mining), **reselling illicit API access** on underground markets, **exfiltrating prompt/conversation data**, and attempting **pivoting into internal systems** via publicly accessible **Model Context Protocol (MCP) servers**. Separately, Palo Alto Networks **Unit 42** described a proof-of-concept phishing technique where a benign-looking page calls a legitimate LLM API to generate **per-victim JavaScript** in real time, assembling a **personalized phishing site** in the browser to reduce the presence of static indicators and evade traditional detections; researchers noted similar building blocks are already being used for obfuscated JavaScript and malware-related activity.
Jun 29, 2026
Cybercriminals are increasingly leveraging generative AI and large language models (LLMs) to enhance the sophistication, scale, and impact of their attacks. Reports highlight a dramatic rise in advanced phishing, digital fraud, and malware development, with AI enabling attackers to automate social engineering, generate convincing fake identities, and bypass traditional security controls. The use of AI has led to a significant increase in phishing email volume and a 180% surge in advanced fraud attacks, as criminals deploy autonomous bots and deepfake technologies to evade detection and inflict greater damage. Security researchers have observed malware authors integrating LLMs directly into their tools, allowing malicious code to rewrite itself or generate new commands at runtime, further complicating detection efforts. These developments mark a shift from low-effort, opportunistic attacks to highly engineered campaigns that require more resources to execute but yield far greater impact. The rapid adoption of AI by threat actors underscores the urgent need for organizations to reassess their defenses and adapt to the evolving threat landscape.
Jun 29, 2026
Recent research and industry analysis highlight the growing influence of large language models (LLMs) in both cyber defense and cybercrime. A study from the University of Bari demonstrated that LLM-generated phishing awareness training can measurably improve users' ability to detect phishing emails, with participants showing increased recall, precision, and overall detection skill after receiving AI-tailored lessons. The research found that even simple prompting methods, which personalize training based on user profiles, were as effective as more elaborate approaches, suggesting that LLMs can efficiently enhance phishing resilience through adaptive, scalable training content. Meanwhile, security researchers have observed that LLMs are accelerating the operational tempo of ransomware groups rather than fundamentally changing their tactics. LLMs are enabling lower-skilled threat actors to develop functional tools and infrastructure more easily, contributing to a proliferation of smaller, agile ransomware crews. These models also facilitate faster reconnaissance, phishing, and negotiation processes, and their multilingual capabilities expand the reach of cybercriminals. While LLMs have not introduced revolutionary new attack techniques, defenders should anticipate continued incremental efficiency gains among adversaries leveraging AI-driven tools.
Jun 29, 2026