Dark LLMs in Threat Intelligence: How Malicious AI Models Are Industrialising Cybercrime
From WormGPT 4 to free GitHub tools and malware that queries an LLM mid-attack, dark LLMs are lowering the skill barrier for phishing and ransomware, and defenders need to adapt.
Why Dark LLMs Belong on the Threat Intelligence Radar
"Dark LLMs" are language models that have been built, fine-tuned or wrapped specifically for offensive use, with the safety filters of mainstream assistants stripped out. They are sold the same way as any other crimeware: through Telegram channels and underground forums, with monthly plans, lifetime licences and customer support. For threat intelligence teams they are no longer a curiosity. They change how fast attacks are prepared, how polished they look, and who is able to launch them.
From WormGPT to a Crowded Market
The category first drew wide attention in July 2023 with WormGPT, a subscription tool its creator said was built on the open-source GPT-J model and tuned on malware-related data. The developer pulled the plug within weeks, blaming the publicity, but the name stuck and the business model spread.
In late September 2025 a new "WormGPT 4" began selling on Telegram and underground forums at about $50 a month, $175 a year or $220 for lifetime access, with source code reportedly on offer as well. Researchers who tested it got convincing phishing and business email compromise text, malware templates and a working ransomware-style script with a ransom note. Its Telegram channel had passed 500 subscribers.
At the other end of the market sits KawaiiGPT, first seen in July 2025. It is free, published on GitHub and takes only minutes to set up on a Linux machine. In testing it produced a bank-themed spear-phishing lure, lateral-movement and data-exfiltration script templates and a ransom note. Its makers claim more than 500 registered users.
Premium offerings such as Xanthorox advertise their own models, offline use and all-in-one toolkits for a few hundred dollars a month. Analysts who examined it found the marketing far ahead of reality. That is a recurring pattern: many dark LLMs turn out to be thin wrappers around jailbroken mainstream models rather than truly new AI.
When the Model Moves Into the Malware
The bigger shift is AI being used inside live operations, not just to write lures. In November 2025, researchers documented PROMPTSTEAL, a data-mining tool linked to the Russian group APT28. Instead of carrying fixed commands, it queries an openly hosted coding model at runtime to generate one-line Windows commands for collecting system information and documents. It was described as the first malware seen querying an LLM in live operations.
The same report described PROMPTFLUX, an experimental dropper that asks a model to rewrite its own code to dodge detection. It looked unfinished, but it shows where things are heading: malware whose behaviour is generated at runtime is much harder to pin down with static signatures.
Criminals Are Exposed Too
The ecosystem has its own weak points. In February 2026 a forum user claimed to have leaked a WormGPT customer database of around 19,000 accounts, with emails and subscription records. The claim has not been confirmed. Even so, it is a reminder that people who buy these services leave payment trails, accounts and chat logs that investigators can later use.
What This Changes for Defenders
Bad grammar and sloppy code are no longer reliable warning signs. AI-written phishing reads cleanly, is localised and can be produced at volume, so awareness training has to focus on the request itself: urgency, payment changes, credential prompts and unusual channels.
Attack preparation that used to take days now takes minutes. Detection should lean on behaviour rather than on matching known samples. That means watching script interpreters, LOLBin chains, mass file encryption and unusual data staging.
Outbound calls to AI services are a new signal. Malware that queries a model at runtime has to reach a public API or a model-hosting platform. Logging and baselining which hosts talk to AI endpoints, and alerting when servers or unusual processes start doing so, can catch this early.
Identity controls still win. Phishing-resistant MFA, conditional access and payment verification steps blunt even a flawless AI-written lure.
Tracking Dark LLMs as an Intelligence Discipline
Mature threat intelligence programmes now treat malicious AI tools like any other crimeware family. They track new brands and rebrands on forums and Telegram, separate marketing claims from tested capability, and map what each tool actually produces (phishing, loaders, ransomware scripts) to ATT&CK techniques. They also watch for model API abuse within their own estate.
Analyst Take
Dark LLMs have not created new kinds of attacks. What they have done is industrialise old ones. The skill barrier has dropped, output quality has gone up, and the first real cases of malware consulting a model mid-attack have appeared. The defensive answer is not to chase every new "GPT" brand. It is to build detection and identity controls that hold up no matter how good the attacker's writing or code has become.
