Weaponized AI: The Commoditization of Cybercrime

By Jambul Tologonov · August 12, 2026

Executive Summary

The Trellix Advanced Research Center has been actively monitoring dark web forums and criminal communication channels for emerging threats tied to artificial intelligence (AI). What we are observing in 2026 is not speculative – it is operational. Underground threat actors are no longer simply discussing AI as a future capability. They are advertising, selling, and deploying AI-enhanced tools and services with increasing sophistication and commercial maturity.

This blog documents the findings from our underground intelligence collection efforts, spanning autonomous kill-chain planning engines, uncensored AI-as-a-service platforms, AI-enhanced malware crypters, stolen API credential markets, and AI-assisted insider threat tooling. Taken together, these observations define a threat landscape undergoing a structural shift: the barrier to entry for conducting advanced, persistent, and evasive attacks is being systematically lowered by the commoditization of AI capabilities within criminal ecosystems. For security practitioners, defenders, and researchers, understanding this shift is not optional.

Introduction

For years, the security community has debated the degree to which AI would transform the offensive threat landscape. That debate is now largely settled by observable evidence. In the first half of 2026, the Trellix research team identified multiple distinct AI-related offerings across major underground forums. These offerings span the full spectrum of the attack lifecycle, from initial reconnaissance and exploit development through payload delivery, evasion, and post-compromise operations.

What distinguishes the current moment from earlier periods of AI hype in criminal communities is the shift from experimentation to commercialization. The services documented here are not proof-of-concept (PoC) demonstrations or theoretical discussions. They are structured commercial offerings with pricing tiers, support channels, update cadences, and in some cases, customer reviews. This maturation mirrors the broader evolution of the cybercriminal economy, where specialization and service-based models have long been the norm for ransomware, initial access brokerage, and exploit development.

The integration of AI into this existing commercial infrastructure represents a qualitative change in capability, not merely a quantitative one. Tasks that previously required skilled human operators working across multiple tools and data sources are being compressed into single-prompt workflows. Evasion techniques that previously required manual tuning per target environment are being automated through per-build morphing.

This report covers seven distinct findings. Each is presented with technical context, cyber threat intelligence significance, and relevance to the broader security landscape in 2026.

APEX AI – nation-state-grade attack planning service

On DarkForums, a threat actor operating under the handle Shadowx007 advertised a service called APEX AI, described as a self-hosted, uncensored offensive AI tool explicitly positioned to provide APT-grade attack planning. The service accepts a target domain as input and returns a complete, prioritized attack path to ransomware deployment, including exact commands for each step. It integrates OSINT sources natively, specifically Shodan and DeHashed, and operates in two distinct modes: an APT Simulation mode that generates an autonomous full kill-chain for a single target, and a Pentest Mode that produces OWASP and PTES-aligned checklists with exact commands.

The sample output published in the advertisement is operationally specific in a way that warrants attention. From a single domain input, the tool reportedly identified a Jenkins instance with exposed AWS credentials, a known Pulse VPN CVE, and a spearphishing vector targeting a recently appointed CISO. Whether the tool consistently delivers on this claim is unverifiable from external observation, but the marketing is clearly targeted at buyers who understand what a kill chain is and are evaluating the tool against manual tradecraft.

The self-hosted deployment model is the most significant technical characteristic of this offering. Unlike API-based criminal AI services, a self-hosted instance produces no provider-side telemetry, cannot be account-banned, and is not subject to takedown through provider policy enforcement. The operator is selling software, not a service, meaning each buyer runs their own instance with no dependency on the original vendor’s infrastructure remaining operational.

In a separate instance, a possibly related threat actor using the moniker ApexDev on Exploit forum published a PoC exploit for the WinRAR vulnerability CVE-2025-8088. This exploit was reportedly generated by APEX-AI, hosted at hxxps://ai-apex[.]io, which likely represents the successor to the self-hosted APEX AI system:

Original post (translated from Russian):

The actor shared a demo and a download link to an executable but withheld the source code. The malicious exploit tool reportedly leverages the WinRAR path traversal flaw to establish persistence on victim hosts by adding payload files to the system startup directory. The WinRAR bug used in the AI-generated exploit appears to be CVE-2025-8088. This critical vulnerability, discovered in July 2025, has been attributed to exploitation by Russia- and China-linked nation-state actors as well as other financially motivated threat groups.

The combination of integrated OSINT aggregation, attack-chain reasoning, and exact command generation represents what we are calling capability compression: tasks that previously required a skilled operator to perform manually across multiple tools are being automated into a single prompt-to-kill-chain workflow. The DarkForums thread showed active buyer interest within 24 hours of the original advertisement, with a number of posts indicating genuine commercial engagement.

AI-enhanced metamorphic crypter

While APEX AI targets the planning and exploitation phases of an attack, the next finding addresses the delivery and evasion layer – specifically, the challenge of getting a payload past endpoint defenses once a target has been identified.

On the Exploit forum, a threat actor operating as ImpactSolutions operates a commercial crypter service marketed under the name Metamorphic Crypter, with explicit claims of FUD (Fully Undetectable) status against Windows Defender and most antivirus solutions. The service generates a unique, morphed build for each crypt operation, with the morphing and obfuscation logic incorporating AI-driven variation to prevent signature-based detection across builds. The technical approach combines DLL sideloading and direct syscalls, targeting both AV and EDR detection layers simultaneously.

The AI-enhanced metamorphic crypter is specifically designed to defeat signature-based detection at scale: because each build is unique, a detection signature developed for one sample does not apply to the next. This is not a novel concept in malware development. Still, the integration of AI-driven variation into the per-build generation process represents a meaningful advancement in the automation of evasion.

The forum thread documenting this service reveals a mature, actively maintained commercial operation with a versioned update cycle, a public review, a support dispute, and a strategic product expansion discussion, all within a five-week observation window. This is not a one-off tool release. It is an ongoing criminal software business operating within Exploit’s marketplace infrastructure.

The service’s quality control posture is particularly notable from a threat intelligence perspective. The operator reportedly rejects incompatible payloads rather than accepting payment for builds that would fail to meet the FUD guarantee. This behavior is consistent with a professional operation focused on protecting its reputation and retaining repeat customers, a pattern more commonly associated with legitimate software vendors than criminal tool developers. The potential bundling of this crypter with delivery services would make it a more complete initial-access commodity, reducing the number of distinct vendors a threat actor needs to engage to execute a full attack chain.

MessiahGPT – purpose-built criminal AI with zero-RLHF architecture

Beyond tools that enhance specific attack phases, a parallel market has emerged for uncensored AI models that entirely remove the ethical guardrails built into commercial platforms.

A service calling itself MessiahGPT is being actively marketed on BreachForums and operates a live platform at messiahgpt[.]de with an associated Telegram community. The service advertises itself as the first AI model trained with zero ethical constraints, no Reinforcement Learning from Human Feedback (RLHF), no Constitutional AI, and no concept of harm or illegality. It offers 50 free queries with no registration requirement, followed by paid plans starting at $8 per month, accepting only cryptocurrency with no KYC requirements.

This is not a jailbreak prompt applied to an existing commercial model. The operator claims to have trained a custom model from scratch on what they describe as unrestricted manuals, dark web archives, leaked documentation, and raw internet scrapes with zero post-filtering. The listed architecture is a “Mixture of Experts” with 128 experts and 16 of them active per token. Whether these technical claims are accurate is unverifiable from external observation, but the service is live, and the market positioning is unambiguous.

The explicit use cases listed in the advertisement include ransomware, stealers, crypters, rootkits described as complete and compilable, phishing kit generation, social engineering scripts, physical attack planning, chemical and explosive synthesis, fraud and carding guides, and data breach exploitation. The advertisement includes a comparison table that directly benchmarks MessiahGPT against ChatGPT-4o, DeepSeek-V3, and Mistral-Large, framing it as the only model that produces outputs across all categories the others refuse. This is product marketing targeted at a sophisticated criminal audience that already understands the limitations of mainstream models and is actively seeking alternatives.

The maturation of uncensored AI-as-a-service from informal Telegram bots offering a handful of free queries to a dedicated commercial platform with a custom-trained model claim, a versioned website, and a live demo channel represents a qualitative step in the evolution of this threat category. The operator is not hiding in a private channel. The service is being publicly marketed on one of the most active criminal forums.

Claude and GPT session cookie black market

While services like MessiahGPT offer purpose-built criminal AI, a separate and equally significant market has emerged for accessing legitimate commercial AI platforms through stolen credentials – effectively laundering malicious use through trusted provider infrastructure.

A threat actor operating as admooins on the Exploit forum operates a 24/7 automated bot that purchases Claude session cookies in bulk. The pricing structure is tiered by both subscription tier and remaining usage quota, indicating a mature secondary market with supply-side competition and demand-side price sensitivity:

Original post (translated from Russian):

Separately, multiple threads on Cracked forum confirm an active resale market for Claude Mythos and GPT-5.6 access, with at least one thread operating a referral incentive scheme for cookie suppliers.

A third service, CheapAI (cheap-api[.]shop), explicitly positions itself as an unfiltered API relay, stating that it passes requests directly to the underlying models with zero extra restrictions, no custom firewalls, and no puritan filters layered on top of the API. The service claims to offer access at 65% below official API pricing.

The existence of a tiered pricing structure for stolen session cookies, organized by model tier and remaining quota, mirrors legitimate SaaS pricing models. This is not informal peer-to-peer trading. It is a supply chain with buyers, sellers, automated matching, and implicit escrow through reputation systems. The cookies being traded are almost certainly harvested through credential stuffing, phishing campaigns, or infostealer log markets.

The CheapAI “no extra filters” claim is a specific product differentiator addressing a known pain point in the criminal market: API resellers that add their own moderation layer on top of the underlying provider API. The market has evolved to the point where genuinely unfiltered API access is treated as a premium feature worth paying for.

The threat intelligence significance of this finding extends beyond the immediate criminal use case. When a threat actor uses a compromised Claude session cookie or a CheapAI API key, the malicious prompt originates from a legitimate account. Provider-side logging sees a real account making a request. The criminal’s actual identity is one or more supply chain hops removed from the logged session, creating a structural attribution gap that is difficult to close through conventional provider-side monitoring.

AI interview cheating tool – Rust-based insider threat enabler

The credential supply chain finding illustrates how AI misuse can be laundered through legitimate infrastructure. The next finding takes that concept further, demonstrating how AI tools can be used to fraudulently obtain legitimate access to target organizations in the first place.

A threat actor operating as S.W.I.F.T. on Exploit forum is selling admin panel development services and listed an AI-assisted job interview cheating tool built in Rust as a recent example of completed work. The tool listens to system audio, transcribes the last 20 seconds of conversation on hotkey press, sends the transcript to an AI model with a prompt to identify the question and generate a fast answer, and displays that answer on screen. When a coding problem is presented via screenshot, it also solves and explains the solution. The tool is engineered to be invisible during screen-share sessions on Zoom, Telemost, and similar platforms:

Original post (translated from Russian):

This finding is significant for reasons that extend well beyond individual job fraud. The threat model scales directly to organizational security. A sophisticated attacker can use this tool to pass technical interviews at target organizations, obtain legitimate employee credentials and access, and then conduct insider operations from a position of trust. The attack surface this creates is particularly relevant for organizations in financial services, technology, and critical infrastructure, where insider access carries high value and where technical interview processes are the primary gatekeeping mechanism.

The Rust implementation is technically meaningful. Rust is commonly used for legitimate system tooling, which makes it difficult for most AV and EDR solutions to flag Rust-compiled binaries as inherently suspicious. The screen-share invisibility feature demonstrates that the developer has a working understanding of the detection environment and has specifically engineered around it. The fact that this is being sold as a completed product on a major criminal forum, not as a concept but as a demonstrated example of available commission work, indicates genuine market demand.

DarkGPT – persistent uncensored AI service

Rounding out the picture of the current AI-enabled threat landscape is DarkGPT, which, while not technically novel, illustrates the normalization of openly marketed criminal AI services and the persistence of demand within Russian-speaking underground communities.

A service calling itself DarkGPT has been persistently advertised in various Russian Telegram channels. The service offers bot access with three free queries followed by paid access, and maintains two linked Telegram channels:

Original post (translated from Russian):

The advertisement is notable for its explicit marketing language. It does not attempt to obscure its purpose. The service is marketed directly as a tool for writing malicious code and exploits without restrictions, creating hacker scripts, and serving what it calls BlackHat AI: uncensored power for darknet projects. The specific positioning as a persistent, 24/7 assistant for darknet projects signals that the target audience is not curious experimenters but operational criminals with ongoing project requirements.

Whether DarkGPT is a fine-tuned local model or a jailbroken prompt wrapper on top of a public model is unverifiable through external assessment. What is verifiable is that the service is live, actively promoted, and targeting Russian-speaking criminal Telegram audiences. While the concept behind DarkGPT is not novel and has been present in the threat landscape for some time, the service remains a consistently marketed and operational fixture within underground channels. The persistence of the advertisement across multiple reposts and Telegram channels suggests the service is still generating sufficient revenue to justify continued promotion spend.

Why these findings matter in 2026

The findings documented in this report are not isolated incidents. They represent converging trends that, taken together, define a new operational baseline for the threat landscape:

Commoditization of AI-assisted attack planning. APEX AI and similar services are compressing the skill requirements for conducting APT-style intrusions. Tasks that previously required experienced operators working across multiple specialized tools are being automated into single-prompt workflows. This does not mean that every buyer of such a service will successfully execute a sophisticated attack, but it does mean that the population of actors capable of attempting such attacks is expanding.

Industrialization of AI-enhanced evasion. The Metamorphic Crypter represents a category of tooling that directly undermines signature-based detection at scale. As AI-driven per-build variation becomes a standard feature of commercial crypter services, the effectiveness of signature-based controls as a primary defensive layer will continue to decline. This accelerates a shift that was already underway toward behavioral detection, but it does so faster than many organizations have adapted.

Structural attribution gaps through compromised AI credential supply chains. The Claude cookie market and services like CheapAI create a layer of indirection between criminal actors and the AI systems they are using. This is not a new problem in cybersecurity, but its application to AI systems is new and has specific implications for provider-side monitoring, incident response, and attribution analysis.

Expansion of AI-enabled insider threat vectors. The interview cheating tool represents a category of threat that most organizations are not currently equipped to detect or defend against. The combination of AI assistance, screen-share invisibility, and Rust-based implementation creates a tool that is specifically engineered to evade the controls that organizations rely on during the hiring process.

Normalization of openly marketed criminal AI services. The public marketing of MessiahGPT and DarkGPT reflects a growing confidence among criminal operators that the risk of advertising such services openly is manageable. This normalization has implications for the speed at which new entrants can discover and adopt these capabilities.

Conclusion

The findings presented in this report represent a snapshot of a rapidly evolving threat landscape. In the first half of 2026, the Trellix Advanced Research Center has observed AI capabilities moving from the periphery of criminal tooling into its operational core. The services documented here are not experimental. They are commercial, maintained, and in active use among the underground cybercriminal communities.

The implications for the security industry are structural. Defenses built around signature-based detection, manual threat hunting, and perimeter-focused controls are increasingly insufficient against adversaries who can automate kill-chain planning, generate unique evasive payloads at scale, and operate through compromised legitimate accounts. The insider threat surface is expanding in ways that bypass traditional hiring controls.

At the same time, the visibility that underground monitoring provides into these capabilities is itself a defensive asset. Understanding what tools are available, how they are marketed, and what capabilities they claim allows defenders to anticipate attack patterns, prioritize detection engineering efforts, and make more informed decisions about where to invest in defensive controls.

Trellix Advanced Research Center will continue to monitor these developments and publish findings as the threat landscape evolves. The adversary is moving fast – and so must we.

Recommendations for organizations

Based on the findings documented in this blog, Trellix provides the following strategic recommendations to help organizations adapt their security posture against the evolving landscape of AI-enabled threats:

• Prioritize behavioral detection: Shift focus from signature-based detection to behavioral analysis. Monitor for process injection, anomalous parent-child relationships, unauthorized audio/screen capture, and suspicious API calls used by AI-enhanced crypters.
• Adopt AI-orchestrated defense: As AI-based cyber attacks increase, traditional manual response is insufficient against machine-speed threats. Adopt AI-orchestrated solutions like Trellix Wise AI to enable autonomous, high-speed defense, ensuring your security operations can keep pace with the evolving threat landscape.
• Adapt incident response for AI-driven threats: Update incident response playbooks to specifically address "authorized-looking" threats resulting from compromised AI session credentials.
• Coordinate with AI service providers: Collaborate with providers to address attribution gaps caused by the secondary market for stolen AI service providers session cookies and improve monitoring capabilities.
• Treat identity as the perimeter: Implement strict conditional access and MFA for AI session initiations. Treat "authorized" sessions showing bot-like activity (unusual IP, device, high query volume) as compromised.
• Enhance proactive threat intelligence: Monitor underground forums and criminal channels directly for emerging AI tooling to anticipate attack patterns, rather than relying solely on passive feeds.
• Secure hiring processes: Update interview processes to mitigate risks from real-time AI assistance, ensuring technical assessments include measures to detect or prevent unauthorized AI aid.

Discover the latest cybersecurity research from the Trellix Advanced Research Center.