PUB-667CCAC003Proliferation of AI Cybercrime Tools Across Underground Markets
A report from Halcyon's Ransomware Research Center documented a surge in underground cybercrime marketplaces selling illicit AI tools, jailbreak prompts, compromised accounts, and malicious models like WormGPT. Advertisements grew from fewer than 50 per month in late 2025 to over 1,400 by February 2026 across Telegram channels, dark web forums, and specialized markets, facilitating lower-cost cyberattacks, identity fraud, and automated scam infrastructure.
What happened
A report from Halcyon's Ransomware Research Center documented a surge in underground cybercrime marketplaces selling illicit AI tools, jailbreak prompts, compromised accounts, and malicious models like WormGPT. Advertisements grew from fewer than 50 per month in late 2025 to over 1,400 by February 2026 across Telegram channels, dark web forums, and specialized markets, facilitating lower-cost cyberattacks, identity fraud, and automated scam infrastructure.
Commercialization and commodification of illicit AI tools, compromised accounts, and jailbreak services lower the barrier to entry for cybercrime and fraud across sectors.
Evidence excerpts
- Advertisements for AI tools on underground platforms surged from under 50 per month in late 2025 to over 1,400 by February.
- Halcyon studied nearly 4,000 underground posts across 77 Telegram channels, 20 dark web forums, and five markets.
- Underground sellers offered compromised ChatGPT Plus accounts, jailbreak prompts, phishing tools, and malicious models like WormGPT.
- Scam tools sold in these markets include AI infrastructure capable of calling up to 120 people simultaneously.
Severity dimensions
Source citations
- AI tools flood into underground cybercrime marketsAxios · 2026-10-06