Criminal actors are offering a range of AI-powered hacking tools and related services for sale on underground forums on the dark web, according to a report released Wednesday by cybersecurity firm Trellix.
Researchers found a wide range of AI-based tools being sold through these markets, ranging from reconnaissance tools to credential markets, as well as AI-as-a-service platforms.
The report shows how AI is being monetized to lower the barriers of entry into sophisticated threat activity.
Some of the major services and hacking tools being offered include the following:
- An actor known as Shadowx007 is offering a service called APEX AI, a tool that provides nation-state-level attack planning capabilities. After inputting a target domain, the service provides a complete attack plan to enable ransomware deployment, including step-by-step commands.
- A threat actor known as ImpactSolutions is offering Metamorphic Crypter, a commercial cryptic service. The service, sold on the Exploit forum, is designed to help attackers bypass any signature-based detection technology. The actor claims the service cannot be detected by Windows Defender and most other antivirus products.
- A service called MessiahGPT is being offered on BreachForums. The service claims to be an AI model that includes zero ethical constraints, unlike many of the leading commercial models in the U.S.
A separate report by researchers at Proofpoint showed indirect prompt injection tools designed to manipulate AI agents. Because malicious commands are hidden, the AI interprets the commands as legitimate and executes the commands as if they were part of the correct decision-making process.
The prompts are embedded in PDFs, emails, web pages and calendar invites and are being offered on underground forums for $150 per month.
Palo Alto Networks previously highlighted how LLMs are processing these malicious requests.
