The hype about evil AI chatbots is mostly noise. What’s actually happening is quieter and more dangerous — criminals are using AI as a productivity layer.
They’re not building autonomous hacking systems. Not yet anyway. Instead, they’re using AI to speed up the boring but essential parts of cybercrime: drafting phishing emails, profiling targets, debugging code, forging documents, translating victim messages, processing stolen data. Stuff that used to take time and skill can now be done faster by anyone with a Telegram bot and a few bucks.
Welcome to Criminal AI-as-a-Service.
The market isn’t a single product. It’s an ecosystem — jailbreak wrappers, Telegram bots, prompt packs, stolen API keys, open-weight models repackaged for illicit use. Some of it works. Some of it is just rebranded public models sold at inflated prices. Many are short-lived. A lot of it is hype.
But the demand is real.
Tools like FraudGPT let entry-level scammers run polished phishing campaigns in multiple languages. GhostGPT runs on Telegram — uncensored output, easy access. WormGPT’s brand name lives on despite the original being shut down in 2023; copycats are everywhere, wrapping commercial APIs like Grok and Mixtral with system prompts that bypass safety guards.
Then there’s BruteForceAI — a different category. It doesn’t generate content. It uses LLMs to analyze forms and execute targeted credential attacks. Fewer attempts, better targeting. That shift — from noisy volume to quiet precision — matters more than any tool name.
Stolen AI accounts are an overlooked piece of this. Compromised OpenAI or Google accounts give attackers access to capable models at someone else’s expense. The accounts often contain proprietary data — prompts, source code, internal docs, customer data.
Deepfake services round out the stack. Face swaps, voice cloning, fake selfies, KYC bypass. Combine that with LLM-generated scripts and stolen personal data, and you’ve got a full deception architecture.
For defenders, the old tells are gone. Bad grammar is no longer a phishing sign. Behavioral detection, identity verification, and process integrity matter more than ever.
