The New Frontier of Malicious AI: What Underground Forums Tell Us About the Evolution of Cybercrime Tradecraft

Public discussion of AI-enabled cybercrime tends to lean heavily on vendor marketing and speculation about future capabilities. We wanted to measure what criminal practitioners are actually discussing, what tools they prefer, and where their attention is shifting.

To find out, the Bitsight Cyber Threat Intelligence (CTI) research team analyzed thousands of posts across 16 selected underground communities — ranging from stolen consumer account resale boards to technically advanced Russian-speaking hacking forums — covering the period from February through August 2026.

We conducted the analysis using the Bitsight MCP server and Threat Hunting Intel Items API to query data conversationally, inspect returned posts, diagnose false-positive patterns, and iterate complex searches within a single session. Through this methodology, we tracked mentions across ten functional keyword categories — spanning jailbreak vocabulary, stolen API keys, AI models, AI agents, and MCP references — and cross-referenced the highest-signal hits against public reporting. While tracking keyword mentions is an imperfect measure, it reliably highlights weight, interest, and where criminal attention is migrating.

The data reveals a decisive shift: the threat landscape is moving past basic chatbot manipulation and toward autonomous agents, open-weights models, and productized attack infrastructure.

This shift also reflects a broader change in how these communities relate to AI. Threat actors are not only exploring AI as a tool to become more effective, they are increasingly hacking AI itself, probing models, agents, and the flows that connect them to real systems. AI is now both a target and a tool, and the sections below look at what that looks like in practice.

Baseline comparison: Mentions of general cybercrime terms drop while AI interest surges

To understand if AI interest was genuinely growing, we needed a control baseline. We used traditional cybercrime keywords like "ransomware" and "phishing" to measure the general activity level on these same forums in the same time window. If both general terms and AI terms grew, we would just be measuring a busier internet.

But that isn't what happened. Mentions of general cybercriminal terms actually dropped during our study window, while AI-related tradecraft mentions accelerated rapidly.

• +45% / Growth in AI-related discussion across all surveyed forums 
• -49% / Drop in ransomware mentions over the same period 
• -8% / Drop in phishing mentions over the same period

While the drop in ransomware mentions likely has some external causes of its own, such as recent law enforcement takedowns or threat actors migrating to closed channels, the divergent trend lines are telling. Even if some of this data reflects a relative shift in attention rather than absolute volume growth, the direction of the signal is clear: criminal focus is rapidly moving toward AI tradecraft.

Open weights and expert developers replace basic chat tricks

Jailbreaking remains the largest genuine activity we track. But the vocabulary and methods have evolved. The named prompt tricks of 2023 are extinct. Instead, technically capable actors are migrating toward open-weights models.

Actors on prominent Chinese-speaking hacking boards and Russian-language cybercrime forums are explicitly ranking models by how readily they fulfill user requests without triggering guardrails or safety restrictions rather than just capability. Open weights remove the entire enforcement surface — there is no provider-side safety layer, no usage logging, and no bannable account.

We observed sharp growth in mentions of open-weights models like GLM, DeepSeek, and Kimi. Rather than buying "uncensored" APIs, capable operators are renting GPU servers to run locally modified, safety-stripped models, moving the process of abliteration (the process of removing or modifying internal weights to strip away safety guardrails) entirely in-house.

This migration reveals a growing competence hierarchy between expert cybercriminal developers and low-skill actors. For example, mentions of "vibe coding" (i.e. casually generating code via AI prompts without understanding the underlying logic) more than doubled during our research window. But within elite circles, the term functions as a pejorative and a status boundary. Premium tools and sophisticated frameworks are marketed as hand-crafted for the underground, explicitly separating low-skill AI reliance from serious, weaponized tool development.

This commoditization showed up directly on the forums we analyzed. In one price-list thread, a reseller operating under the name CloseRouter advertised flat-rate access to DeepSeek, MiniMax, Qwen, GLM, and other open-weights models alongside ChatGPT, Claude, and Gemini, all around ten cents per million tokens, with no distinction drawn between a legitimate API pass-through and access built for abuse.

Are established malicious LLMs losing ground or just saturated?

Mentions of established, branded malicious LLMs — WormGPT, FraudGPT, GhostGPT, DarkGPT, and EvilGPT — fell 9 percent across our forum set. That's almost exactly the 8 percent decline we measured for the “phishing” keyword over the same window, so against our own baseline, this category is holding roughly flat rather than shrinking outright. Discussion volume of these malicious models appears to be drifting down at the same rate as forum chatter generally is.

Does this mean they are losing ground? Not necessarily. These are now well-established brands. When everyone on a forum already knows what a specific product does, they don't need to keep naming it to keep using it. Mentions of the brand names themselves may simply have saturated, independent of whether actual usage has.

Furthermore, the actual usage of these tools indicates a steady, mature business model. Earlier this year, WormGPT was itself breached, exposing roughly 19,000 users' emails, payment data, subscription tiers, and unique identifiers. What makes this insight particularly interesting is that the sheer scale of that customer base suggests that even if public discussion has plateaued, commercial adoption remains robust. It was the equivalent of a legitimate SaaS company getting breached, complete with real subscription tiers, exposing the customer base of the underground economy to the public.

Ultimately, expert criminals do not need a branded, marketed malicious LLM when they can easily modify an open-weights model or bypass commercial API restrictions architecturally.

Forum architecture is shifting: Dedicated AI boards signal permanent demand

Beyond keyword metrics, the most compelling evidence of AI's prominence in the underground is structural. At least one-third of the cybercrime platforms we analyzed — spanning top-tier Russian-language technical communities, popular Turkish-speaking hacking boards, and consumer resale forums — have created dedicated subforums specifically for AI discussion.  These sections carry explicit titles focused on AI jailbreaks, neural networks, and agent hijacking.

This architectural shift is a crucial indicator. While individual keyword mentions fluctuate week to week, modifying forum structure requires an administrative decision by staff responding to sustained community demand. The establishment of standing AI subsections proves that AI tradecraft has become institutionalized and a permanent feature of the cybercrime economy.

The frontier moves to agent infrastructure and BYOK

The most advanced threat actors are no longer trying to trick a model's safety training. They are attacking packages, registries, tool-calling protocols, and agent harnesses. Mentions of the Model Context Protocol (MCP), AI agents, and indirect prompt injection grew by 67 percent.

The most technically sophisticated artifacts we found did not come from consumer-grade leak boards, but from specialized reverse-engineering communities.

• Autonomous exploit planning: In one of the forums, a reputable actor showed an AI agent using an integration with IDA Pro, a disassembler used for debugging and reverse engineering, to automatically analyze software code, identify a buffer overflow vulnerability, and create a complete exploit plan.

• Enterprise account breaches: On a popular Russian hacking board, another actor demonstrated using a general-purpose AI agent with browser-automation capabilities to successfully breach an enterprise Notion account
• Agentbaiting and supply chain attacks: Forum members are actively dissecting write-ups of real-world supply chain attacks, such as the FakeGit campaign (attributed to the actor "Water Kurita"). In that campaign, roughly 7,600 fraudulent GitHub repositories distributed SmartLoader malware — with over 800 disguised as AI "skills" or MCP servers (such as a malicious lookalike "Docker MCP Gateway") to get indexed in public AI registries. Forum actors circulating and analyzing this "agentbaiting" technique suggests that such interest could potentially lead to replication or it may even indicate a potential risk for copycat attacks targeting AI tool registries. Other campaigns similar to FakeGit, the Shai-Hulud npm worm family (which weaponizes Claude Code session hooks), and the Megalodon repository-backdooring campaign show how adversaries are exploiting AI developer tooling in the real world.

The underground is also successfully productizing AI attacks through Bring Your Own Key (BYOK) architecture. We observed MONST3R-AI, an autonomous AI penetration testing platform marketed on a highly restricted forum. Its seller claimed 1,072 findings across 199 scanned hosts; that is a self-reported dashboard figure we cannot independently verify, but even if a small percentage of it is accurate, it represents an effective tool that will only become more potent over time. 

Instead of hosting a malicious model, the seller built a panel where the buyer pastes in stolen OpenAI, Anthropic, or Google API keys, sets a budget cap, and unleashes the agent on a target list. The provider's safety training is bypassed architecturally, and the API bill lands on the victim whose key was stolen.

Key trends and where this goes next

Taken together, the trends in this study describe one underlying transition: the underground is moving from a retail market for AI capability to a build economy. Two years ago, breaking a model's rules meant paying for a jailbroken chatbot subscription or copying a prompt someone else engineered. Today the more capable path is renting a GPU, running an open-weights model with no provider watching, and wiring it into an agent that can act on its own. Jailbreaking hasn't gone away, and it's still the single largest category we tracked. But it has become the entry-level tier of a market that now has real depth above it: weight-level modification, agent tooling, and infrastructure-level attacks that don't touch a model's guardrails at all.

That shift matters because it changes where the risk actually sits. A market built around branded products is comparatively easy to watch; you can track WormGPT, FraudGPT, or whichever name is trending, and get a rough read on activity. A market built around commodity open-weights models running on rented hardware, feeding into custom agent harnesses, has no brand to watch. It's diffused by design, and it is exactly the part of this study that grew fastest.

Drawing on these findings and observed patterns, we can anticipate the following developments in the cybercrime ecosystem:

• Agents over models: The underlying model will matter less than the agent harness wrapped around it. Attackers will continue to focus on autonomous tooling and orchestration layers that can independently execute logic flaws, brute force accounts, and scour exposed environments.
• BYOK productization will become mainstream among lower-skill and opportunistic actors. Wrapping commercial AI models in an offensive harness using stolen provider credentials is highly cost-effective and scalable for actors who don't have the skill or infrastructure to run their own models. We expect to see an increase in underground marketplaces selling stolen API keys purely to fuel autonomous scanning engines.
• Open-weights models will dominate custom malware creation among higher-tier adversaries. As local GPU hosting becomes cheaper, these more capable adversaries will increasingly abandon commercial APIs entirely for custom tool development, relying on unmonitored open-weights instances to bypass vendor oversight rather than renting access to one.

Actionable defense strategies: How to mitigate emerging AI threats

The threat has fundamentally changed, and defensive postures must evolve beyond generic advice. Security teams need to adapt to a landscape where autonomous agents and stolen API keys are primary weapons.

• Implement aggressive secret scanning for AI API keys: Exposed Anthropic, OpenAI, and Google keys are highly lucrative and actively traded on underground forums to fuel BYOK attack platforms. Treat an exposed AI provider key with the same severity as an exposed AWS credential.
• Audit and constrain MCP extensions and AI skills: Supply chain poisoning now specifically targets the AI infrastructure layer. Verify the provenance of all MCP servers, coding assistant extensions, and agent plugins used by your engineering teams to prevent "agentbaiting" supply chain compromises.
• Monitor outbound tool-calling behavior in developer environments: AI coding assistants integrated into your IDEs can be manipulated by malicious repositories. Enforce strict least-privilege access for agent harnesses running locally, ensuring they cannot read sensitive local directories or execute arbitrary shell commands without explicit human approval.
• Detect anomalous autonomous traffic: Security teams must baseline normal human interaction rates against enterprise platform behavior. AI agents driving headless browsers operate at distinct cadences. Tune rate-limiting and behavioral analytics to catch automated, agent-driven authentication attempts targeting platforms like Notion, Slack, and GitHub.

Security and risk leaders must move from managing risk to predicting it. Understanding how the underground iterates on AI is a critical step toward staying ahead of the next wave of autonomous threats.