Loading story…
Cybercrime forums have sharply increased discussion and sales activity around malicious AI tools, with researchers reporting a 219% rise in mentions of dark AI tools and tactics and a 52% increase in references to jailbreaking mainstream platforms such as ChatGPT. These offerings include jailbroken versions of public generative AI services and customized tools built on open-source large language models, often sold as AI-as-a-Service to support phishing, business email compromise, deepfakes, fraud, vulnerability analysis, malware development, identity fraud, password attacks, credential stuffing, and DDoS operations.
Reporting on the underground market says well-known brands such as WormGPT and FraudGPT are only the most visible examples of a broader ecosystem of rebranded, resold, and short-lived criminal services. Analysts say the main effect of these tools is not breakthrough offensive capability but the removal of safety guardrails, making it easier for lower-skilled actors to generate convincing scam content and some malicious code; the market has also shifted toward repurposed open-source uncensored models, while scams targeting criminals and a reported leak of nearly 19,000 WormGPT user accounts highlight instability and risk inside the ecosystem itself.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The analysis cites a reported 2026 leak of nearly 19,000 WormGPT user accounts, highlighting operational risk within the criminal ecosystem itself. It presents the leak as an example of growing scrutiny and exposure affecting malicious AI services.
The malicious AI market shifted after 2023 toward repurposed open-source uncensored models, which the analysis says can deliver similar outputs without paid subscriptions. The article describes WormGPT and FraudGPT as part of a broader ecosystem of rebrands, resellers, and short-lived services rather than stable standalone products.
Kela reported that cybercrime-underground mentions of AI abuse rose sharply during 2024, including a 52% increase in mentions of jailbreaking tools such as ChatGPT and a 219% increase in mentions of malicious AI tools and tactics. The report said these tools were being used to scale phishing, deepfakes, fraud, vulnerability analysis, malware development, identity fraud, password attacks, credential stuffing, and DDoS activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Underground operators are increasingly packaging generative AI into **criminal AI-as-a-service** offerings that support phishing, fraud, impersonation, malware modification, translation, and post-breach data analysis. Reporting on the market describes branded tools such as **FraudGPT**, **GhostGPT**, and **WormGPT**, but says many are little more than wrappers around legitimate models, stolen accounts, or hijacked API keys rather than fully autonomous hacking platforms. Researchers also highlighted a parallel market for deepfake-enabled abuse, including voice cloning, face swaps, fake selfies, and virtual camera injection used for KYC bypass, synthetic identity fraud, and onboarding scams. Sophos separately identified a malware development lab using AI tools including **Cursor** and **Claude Opus** to speed ransomware-related coding, payload refinement, and evasion testing. The framework reportedly generated Python-driven Rust and Go malware modules, customized **Cobalt Strike** profiles, Telegram-based command channels, Cloudflare Worker intermediaries for command-and-control traffic, code-injection scripts targeting legitimate Windows applications, and AI-assisted Active Directory reconnaissance. Researchers said the operation tested nearly 80 modules against more than 70 evasion methods across Sophos, CrowdStrike, and Microsoft defenses, reinforcing that the immediate risk is not autonomous AI malware but faster, cheaper, and more scalable attacker workflows.
Jun 29, 2026
A growing underground market for AI-powered hacking tools is emerging on dark web forums, according to research from Palo Alto Networks' Unit 42. These tools, including commercialized versions like WormGPT and free models such as KawaiiGPT, are designed to assist cybercriminals with tasks such as vulnerability scanning, data encryption, and generating malicious code. The accessibility and user-friendly nature of these large language models (LLMs) are significantly lowering the technical barriers for cybercrime, enabling even unskilled individuals to create attack scripts and conduct cyberattacks using simple conversational prompts. While the technical sophistication of these "dark LLMs" remains limited, their primary impact is in democratizing cybercrime by empowering low-level hackers and script kiddies. The tools are particularly useful for generating grammatically correct phishing emails and basic malware, especially for users operating across language barriers. Despite initial fears of highly advanced AI-driven cyberattacks, current evidence suggests that these models are more effective at aiding petty criminals than enabling complex, autonomous cyber operations.
Jun 29, 2026
Sophos X-Ops found that cybercrime forums including Exploit, XSS, Breach Forums, and Hackforums are discussing large language models, but adoption remains limited and cautious. Researchers observed multiple GPT-branded services marketed to criminals—such as **WormGPT**, **FraudGPT**, **Evil-GPT**, **DarkGPT**, **WolfGPT**, **BlackHatGPT**, **HackBot**, **PentesterGPT**, **PrivateGPT**, and **XXXGPT**—yet many forum users questioned whether the tools were effective, accused some offerings of being scams, or dismissed them as little more than jailbreak prompts wrapped in criminal branding. The activity that did appear was largely experimental rather than operational. Sophos reported that most observed uses focused on social engineering, routine coding help, jailbreak attempts, and trading compromised ChatGPT accounts, while examples of AI-generated malware or attack tooling were rare, generally unsophisticated, and often Python-based. Forum participants also raised concerns that using ChatGPT could expose their activity to monitoring, leak operational details, or strengthen defensive systems, prompting some to favor offline or self-hosted models instead of mainstream AI services.
Jun 29, 2026