FraudGPT emerges on the dark web for cyberattacks
Threat actors just launched FraudGPT, an offensive generative AI tool designed specifically to craft spear phishing emails, write undetectable malware, and find system leaks. Selling for $200 a month on Telegram and dark web forums with over 3,000 confirmed sales, it strips away standard safeguards. Why it matters: unrestricted LLMs are making sophisticated cybercrime accessible to novice bad actors at scale.
Just as mainstream tech giants race to put guardrails on their chatbots, cybercriminals are busy packaging their own unrestricted versions.
A new malicious generative AI tool dubbed FraudGPT has surfaced on dark web marketplaces and Telegram channels, according to a report from Netenrich security researcher Rakesh Krishnan. The tool has been circulating since at least July 22, hot on the heels of the recently discovered WormGPT.
A turnkey cybercrime bot for $200 a month
The tool is being promoted by an actor using the handle CanadianKingpin, who markets it as an all-in-one ChatGPT alternative with zero boundaries.
It is sold strictly as a subscription service. Access costs $200 per month, $1,000 for six months, or $1,700 for an entire year. The seller even claims to have racked up more than 3,000 confirmed sales and reviews already.
Under the hood, it remains unknown which specific large language model powers the system. What is clear, however, is what buyers are using it for.
According to promotional material, FraudGPT is designed specifically for offensive tasks. It can write convincing spear-phishing emails, create cracking tools, assist in credit card fraud, discover system vulnerabilities, and generate undetectable malware code.
Why it matters
We are looking at the rapid commercialization of offensive AI as a service.
Writing polished spear-phishing campaigns and convincing business email compromise lures used to require decent research and natural language skills. Tools like FraudGPT automate that entire bottleneck for just $200 a month, lowering the barrier to entry for novice criminals.
As Krishnan pointed out, stripping safety safeguards away from generative AI is not technically difficult. That means the offense currently has a cheaper, faster playbook than enterprise defense.
For companies and everyday users, the old advice of looking for typos or awkward phrasing in scam emails is officially dead. Security teams will have no choice but to rely on automated AI telemetry and defense-in-depth setups just to catch these attacks before they turn into full-blown ransomware or data breaches.
Sources (1)
- thehackernews.com(opens in a new tab)Originalthehackernews.com
Topic trackerRise of AI-powered cybercrime tools
- Dark web cybergangs are selling AI fraud tools as a service
- FraudGPT emerges on the dark web for cyberattacksThis story