Increase in AI Tools Available on Underground Cybercrime Markets

<p>Research shared with Axios indicates that hackers in underground cybercriminal forums are increasingly purchasing new AI tools. </p><p><strong>Importance:</strong> The availability of AI is making specialized hacking capabilities cheaper and more accessible, which may lead to a rise in the number of criminals engaging in cyber activities.</p><hr /><p><strong>Statistics:</strong> Advertisements for AI tools on underground forums rose from fewer than 50 per month in late 2025 to over 1,400 by February, according to a report from Halcyon's Ransomware Research Center.</p><ul><li>Sellers are offering access to ChatGPT Plus accounts for as low as 10 cents and jailbreak prompts for 32 cents, according to the research.</li><li>Halcyon analyzed nearly 4,000 posts across 77 Telegram channels, 20 dark web forums, and five specialized underground markets from October to May.</li></ul><p><strong>Financial Impact:</strong> Companies are reportedly losing millions of dollars due to cyberattacks facilitated by tools available in these underground markets.</p><ul><li>Cynthia Kaiser, head of Halcyon's Ransomware Research Center and former deputy director of FBI Cyber, stated, "It really goes to show you how cheap it is to conduct these activities ... which should be scary for organizations."</li></ul><p><strong>Overview:</strong> The sale and creation of these tools have become commercialized, often resembling software-as-a-service subscription models and online storefronts.</p><ul><li>Some sellers are promoting AI tools tested on traditional dark web forums through more manageable storefronts on Telegram.</li><li>Kaiser noted, "What we should take away from this is also how much cybercriminals have learned throughout the years about how to sell and package — and they applied this really quickly to the AI models."</li></ul><p><strong>Types of AI Tools Sold:</strong></p><ul><li>Jailbroken and stolen AI services, including prompts that allow users to bypass safety measures for as little as $10.</li><li>Identity fraud and phishing tools that simplify impersonation.</li><li>Access to models trained on malicious data, such as WormGPT, which is designed for writing phishing emails and malware.</li><li>AI-augmented malware and infrastructure, including systems capable of making up to 120 calls simultaneously for scam operations.</li></ul><p><strong>Historical Context:</strong> In 2023, hackers had limited access to tools, but the current marketplace is much more developed.</p><ul><li>Kaiser mentioned that AI is primarily assisting criminals in performing specific elements of existing attacks more efficiently.</li><li>She added, "What you're not seeing for sale is an agent that does it all for you and has this amazing success rate."</li></ul><p><strong>Future Considerations:</strong> Halcyon did not find evidence of criminals selling AI systems capable of executing fully autonomous cyberattacks.</p><ul><li>Kaiser stated that much of what researchers are observing involves coding assistance and infrastructure rather than AI autonomously creating and deploying malware.</li></ul><p><strong>Further Reading:</strong> <a href="https://www.axios.com/2026/10/03/rogue-ai-agents-internet-defenses" target="_blank">Rogue AI agents expose internet's frail foundation</a></p>