Ukraine’s unprecedented drone rescue of a wounded soldier from the battlefield has shown once again how battlefield necessity can spur innovation. The operation was revealed just days after separate Ukrainian drones designed for casualty evacuation were deployed for frontline testing—taking a step beyond the US military’s decades of experimentation with similar concepts.
The drone evacuation of the injured soldier took place at an undisclosed time and place on the frontline where the presence of Russian drones and landmines made it impractical to send in a wheeled ground robot, according to The Kyiv Independent. On October 19, Ukraine’s Army shared a video of the drone evacuation, showing the wounded soldier securing himself in a harness suspended beneath a heavy hexacopter drone with six rotors before being flown to safety.
“This is a historic event, the next stage of evacuating the wounded, which we will all come to,” said Napalm, a programmer of the 92nd separate assault brigade's unmanned ground systems company, who went by his callsign per Ukrainian military practice, in a statement. “Now the serious systematic work begins, so that such missions are carried out constantly.”
Redundancies beckon as British Cycling restructures while former cyclists and employees raise concerns over return of ‘toxic culture’
British Cycling’s most successful world track championships campaign in over a decade, in which they topped the medal table in the first qualifying event for the 2028 Olympic Games, was achieved against a backdrop of allegations of misconduct and looming redundancies.
Despite a traumatic buildup to the championships in Shanghai, with star sprinter Matt Richardson withdrawn from competition on the eve of the event due to allegations of “discriminatory remarks”, the British squad recovered to win six gold medals, three silver and three bronze.
The world’s first demonstration of a subsea geothermal power plant has taken place near an active underwater volcano almost a mile below the ocean surface. It generated less than 10 seconds of net-positive electricity but showed the technical feasibility of tapping another form of renewable energy underwater.
The three-week test deployment of the 3-ton prototype power plant took place at the Axial Seamount in the northeast Pacific Ocean in September. Endurance Energy, the Seattle-based startup behind the effort, aims to eventually commercialize subsea geothermal power for Pacific island nations and other customers looking for alternatives to importing expensive fossil fuels.
“The deep ocean gives us unlimited cold seawater for cooling, and its weight keeps the system and the well pressurized, so our plants can be compact,” said Andrew Redd, founder and CEO of Endurance Energy, in an email to Ars.
Anchor’s departure not thought to be linked to company’s recent acquisition by David Ellison’s Skydance Media
Christiane Amanpour, one of CNN’s most decorated and venerated journalists, is leaving the network after 43 years, she said in a statement on Monday.
Amanpour, who began working for the then-fledging network as an assistant on the international assignment desk in 1983 and is now its chief international anchor, will end her show Amanpour in May and leave the network at the end of June. She also hosts a show for PBS, Amanpour and Company, that will conclude at the end of this year.
Nearly 100 years after the dirigible Graf Zeppelin made the first nonstop airship journey across the Pacific Ocean, another airship has successfully completed a round-trip flight from New Mexico to Japan and back. But the significance of this modern feat was less about the journey's length and more about its purpose: demonstrating how a lighter-than-air platform can act as a cell phone tower in the sky.
The trans-Pacific flight that took place over a month between August and September 2026 was the most notable milestone yet for Sceye, a US aerospace company based near Albuquerque, New Mexico. Sceye has developed an uncrewed platform filled with helium for buoyancy and equipped with an electric-powered propeller for active propulsion, allowing it to resist most strong winds and keep hovering over the same location for long periods. The platform also uses top-mounted solar panels and onboard batteries to stay powered for stratospheric operations around the clock.
“We can stay over an area of operation, and we do that in the stratosphere right around 60,000 feet, so we're twice as high as air traffic and we're above the jet stream, and yet 30 times closer than low-Earth orbit satellites,” Mikkel Frandsen, founder and CEO of Sceye, told Ars. “We can fly through day and night until the sun comes up the next morning and recharges the batteries, at which point we're still at the same altitude and still over the same area of operation.”
Russian drones are suspected of sinking a cargo ship and leaving chemical tankers ablaze near the Black Sea coasts of Bulgaria and Romania, respectively. The latest attacks mean that at least seven ships have been attacked in the exclusive economic zones of NATO member countries—and even within Romania's territorial waters if Russian involvement is confirmed in the case of the chemical tankers.
Such attacks have spurred requests for NATO to redeploy counter-drone systems to provide more protection. In a social media post on October 15, NATO Secretary General Mark Rutte stated that NATO had increased "counter-drone capabilities" along the alliance's eastern flank after meeting with the leaders of Bulgaria and Romania.
The latest attacks this week occurred within 24 hours between October 14 and October 15, when the two chemical tankers were set afire after Russian drones were detected in Romanian airspace, according to Deutsche Welle. Both ships were sitting at anchor near the mouth of the Sulina canal that connects the Black Sea to the Danube River, which has become a crucial shipping export route for Ukraine, Reuters reported.
Suspected Russian drone attacks sank a cargo ship and forced the evacuation of another vessel within two dozen miles of the coast of Bulgaria in the Black Sea on October 13. The latest attacks mean that five ships have been attacked in the exclusive economic zones of NATO member countries—spurring requests for NATO to redeploy counter-drone systems to provide more protection.
Although there is no hard proof that the drone attacks originated from Russia, one of the ships that came under attack was the Ukrainian-operated coastal freighter Chelsea 3, registered under the flag of Malta. Bulgarian Prime Minister Rumen Radev told the Russian ambassador in Sofia that “it makes no sense for Ukraine to destroy its own ships in the Black Sea, and the results of these strikes favor Russia’s interests,” according to The Associated Press.
All 15 members of the Ukrainian-owned Chelsea 3 were safely evacuated by Bulgarian rescue operations after the ship was reportedly struck by three aerial drones.
Phillips sought to buck up his fellow London bureau colleagues during a contentious staff meeting on Tuesday
The veteran British broadcaster Sir Trevor Phillips had some strong words of advice for his CBS News colleagues when facing off against critics who question the editorial integrity of the network: “Why don’t you just fuck off and let us do our jobs?”
Phillips made his blunt suggestion during a contentious meeting of the network’s London bureau on Tuesday, during which the foreign editor, Shayndi Raice, went on a lengthy tirade criticizing unnamed staffers for suggesting that editorial oversight amounted to “interference” and informing colleagues that disobeying editors would be insubordination and “legal grounds for firing”.
Despite the expansion of Starlink and other communications satellite services, most of the world’s Internet traffic still travels through subsea cables crisscrossing the ocean floors. Those fiber-optic cables coexist with a network of oil and gas pipelines and submarine power cables—and all these crucial links connecting countries and continents now face growing sabotage risks as gray-zone warfare and open conflicts have become widespread.
The rising risks to the world’s invisible infrastructure beneath the waves are the main subject of a new book by Elisabeth Braw, a senior fellow at the Atlantic Council who leads the Threats to the Global Maritime Order Initiative. Her book, titled Undersea War, explores the modern rise in suspicious incidents in which ships dragging their anchors for unusually long periods have cut or damaged undersea cables and pipelines, from the Baltic Sea to the Pacific Ocean.
Braw acknowledges that about 60 percent of undersea cable damage is primarily due to human error during fishing and shipping activities, when weighted nets or anchors drag across the seabed. Natural hazards like storms and undersea landslides also account for a smaller proportion of such incidents. In total, between 150 and 200 cables are damaged each year and usually repaired quickly.
District court judge Timothy Kelly was ruling after the Trump administration blocked access to the three outlets in September
A federal judge ordered the White House on Tuesday to continue allowing journalists from CNN, MS Now and Politico to access the building as the media coalition’s lawsuit against the Trump administration plays out.
Timothy Kelly, a district court judge, had on 24 September granted a 14-day reprieve for the news organizations, which six days earlier had been banned by the president in an extraordinary move from entering the White House grounds “as a result of their constant ‘reporting’ FAKE NEWS”.
BBC asks US federal judge to compel Trump’s lawyers to schedule deposition after his team canceled initial session
The BBC is asking a federal judge in Florida to force Donald Trump to sit for a deposition as part of the president’s $10bn defamation lawsuit against the British broadcaster.
According to a Tuesday filing, the BBC and Trump’s legal team had agreed for him to be deposed on Friday. The BBC’s lawyers wrote to the judge that they had spent months trying to secure a location for the deposition from Trump’s team.
When Russia began attacking Ukrainian data centers and telecommunication infrastructure, it apparently failed to prepare for possible retaliation. Now Russia’s digital services are facing widespread outages after Ukrainian drone strikes knocked out three of the largest data centers owned by Russian tech giant Yandex within several days.
Pro-Kremlin bloggers are warning that Russia’s centralized digital economy could collapse because the country is not prepared for the “data center war” it started, according to poststranslated by the pseudonymous independent researcher ChrisO_wiki. The Russian commentators also suggested that Ukraine’s decentralized digital services could prove more resilient than Russia’s system if the countries continue trading such blows.
Russia initially launched a drone strike campaign targeting Ukrainian data centers and mobile phone networks in late September. The attacks temporarily disrupted Internet and cell phone service for up to 100,000 households in the Ukrainian capital of Kyiv and came as part of a broader long-range strike campaign that has involved Russian missiles and jet-powered drones hitting Ukraine’s power grid infrastructure, transportation hubs, and even residential apartment building blocks.
No organization in the world operates more robots than Amazon. The company already has more than 1 million robots working in warehouses around the clock to make tens of millions of same-day and one-day package deliveries happen on a daily basis—and Amazon is poised to significantly grow that robotic fleet in the coming years as it establishes new factories to churn out increasingly more capable robot workers.
Despite deploying so many robots, Amazon is also the second-largest corporate employer in the world, with more than 1.5 million full-time and part-time human workers, according to its 2025 annual report. Amazon executives say that the growing robot fleet has eased the burden on its human workforce by taking on the toughest fulfillment center tasks that carry the greatest risks of physical fatigue and injury. But labor advocacy groups and independent researchers point to evidence suggesting that warehouse automation driven by AI is not all upside for the humans who work alongside robots.
“For the last 100 years, most of the automation that we've seen usually happens away from workers—you're taking that high-risk task away from the worker, and you're doing so in a way that is not physically proximate,” Brad Greenwood, professor of business at George Mason University, told Ars. “The rise of collaborative robots really changes that dynamic for two reasons: one is that it is physically proximate, and two, the robot has the ability to dictate the pace of work.”
Ukrainian drone strikes have knocked out two of five data centers belonging to the Russian tech giant Yandex. The damage has left Yandex, known as “Russia’s Google” because it operates the country’s most popular search engine, struggling to maintain its AI chatbot and other online services.
The Ukrainian drones struck Yandex data centers in the Sasovo and Kaluga regions of Russia on October 8 and October 9, according to Reuters. Those actions came as a direct response to a Russian drone strike campaign targeting Ukraine’s data centers, which has disrupted mobile phone and Internet services for thousands of Ukrainians since late September.
“We continue to respond to Russia’s attacks on Ukraine, and we’re doing so with high precision,” said Ukrainian President Volodymyr Zelenskyy in a post on X. “Another data center was hit as well—our symmetrical response.”
Investors bullish on AI data centers may be fueling Nvidia’s multitrillion-dollar market capitalization, but the AI chipmaker has also bet billions of dollars on physical AI technologies such as robotics and self-driving cars. Part of that gambit has involved developing a full-stack safety system that companies can build upon to reduce the risk of their machines harming nearby people.
Nvidia's Halos system launched in 2025 with hardware and software tools to help developers implement guardrails in self-driving cars and other autonomous vehicles. Then the company expanded its safety architecture to more physical AI technologies by announcing Nvidia Halos for Robotics in June 2026—with the goal of enabling safe deployments of autonomous mobile robots in warehouses, humanoid robots walking around inside a factory, or even surgical robots.
“Now the AI models are getting capable, the robot hardware is getting capable, and a thing we thought is going to be the next bottleneck is safety,” Amit Goel, head of robotics ecosystem and edge computing at Nvidia, told Ars. “So that's why we launched our Halos for Robotics to unlock the capability of these systems.”
Drones sank two cargo ships and damaged a third in the exclusive economic zones of NATO member countries for the first time, killing at least two sailors. The attacks represent a notable escalation as Black Sea commercial shipping has increasingly come under attack during the Russian invasion of Ukraine, with Russia also being accused of carrying out “hybrid warfare” incidents across Europe.
The Togo-flagged cargo ship Alfa Watan sank, and the Palau-flagged cargo ship Able was set ablaze after being attacked by multiple sea and aerial drones about 80 miles (128 kilometers) off the coast of Bulgaria on October 6, according to the Associated Press. In an interview, Bulgarian Prime Minister Rumen Radev described the incidents as “an unacceptable attack in Bulgaria’s exclusive economic zone” and “a blatant violation of international law and maritime law.”
A Bulgarian ferry managed to evacuate the 18 crew members of the Able, with two severely injured mariners being flown to a hospital in the city of Varna.
A surge in Russian jet-powered drone strikes on Ukrainian data centers has increasingly disrupted mobile phone and Internet services for thousands of people. Now Ukraine President Volodymyr Zelenskyy and other government officials are warning of the need for more air defense capabilities, as such telecommunication outages could threaten Ukraine’s digital economy and undermine the country’s ongoing resistance to Russia’s invasion.
The Russian attacks on Ukrainian telecommunication infrastructure have focused on Ukraine’s capital of Kyiv since September 23, according to the nonprofit Reporters Without Borders. Ukraine’s digital transformation ministry reported that 100,000 households in the Kyiv region were temporarily experiencing Internet outages from those initial strikes—and Russia has only intensified its strike campaign against major Ukrainian data centers and mobile phone networks in recent weeks.
“Russian attacks on Ukraine’s telecommunication infrastructure are not new, with strikes and shelling previously damaging fiber optic lines, cell towers, and facilities belonging to mobile network companies,” said Tetiana Gaviuk, analyst for Europe at ACLED, in a post on October 1. “However, the recent concentrated attacks on Kyiv’s data centers and telecom networks stand out because multiple providers and facilities were hit within days, indicating Russia’s increased pressure on Ukraine’s digital infrastructure.”
My family has spent four summers participating in demand response programs whereby utility companies pay customers to reduce energy use on the hottest summer days. Most summers have involved carefully precooling our New York City apartment before switching off the air conditioners and sweating it out during the designated demand response periods.
But this year, we kept our window air conditioners running throughout a heat dome event that drove daytime temperatures into the triple digits and made the nights oppressively hot. The difference was that we powered the air conditioners through two household batteries tucked away unobtrusively in the corners of our living room and bedroom.
We were among about 1,000 New York City households that took part in a free and growing program offered by the local startup Every Electric. The company’s proposition is simple: Get one or more batteries delivered to your home, plug the batteries into a standard wall electrical outlet, and then plug your window air conditioners into the batteries. Households can keep running air conditioners as usual during peak demand periods while also earning money through the local demand response program with the utility company Con Edison.
A beluga whale named Osiris at the Shedd Aquarium in Chicago in August. It was one of four belugas to die after being transferred from a closed marine park in Canada.
At an event in Washington, partisanship took a back seat as elected officials, religious leaders, parents and artists called for reining in artificial intelligence.
It was only a few weeks ago that we got a massively improved Alpha emulator, capable of running VMS, Windows 2000, and Tru64, including X11 support and a variety of other exciting features. Today, we’ve got another major emulation milestone (update: sadly, with “AI” support, so odds are this will fizzle out. Bummer!).
The emulation space is going crazy, after my previous post on Windows booting on DEC Alpha es40 emulator, there is now another huge breakthrough in the emulation of other non-x86 CPU emulation. Yufeng Gao with help from gdwnldsKSC (the man behind the updated es40-fork) has released version 0.1 of his Intel Itanium (IA-64) emulator that boots the Itanium version of Windows Server 2003 and Windows XP 64-bit. No OpenVMS or HP-UX yet and Linux/BSD also don’t boot. But Windows is amazing already.
Much like Alpha hardware, Itanium hardware is quite hard to come by – especially Itanium workstations are a nightmare to find; I think I’ve only ever seen one or two Itanium workstation come up for sale on eBay in recent years, and their rarity obviously commanded hefty prices. The sooner we are able to run Itanium version of operating systems comfortably in a virtualised environment the better. As long-time OSNews readers know, my heart beats for HP-UX, but the Itanium versions of Windows and VMS would be of more interest to most people, I’m sure.
The underground market for criminally oriented generative AI has moved beyond the early hype surrounding 'malicious chatbots.' The gradual integration of AI as a productivity layer within cybercrime operations has become the dominant story, indicating that while the potential for fully autonomous AI hacking systems is possible, attackers are not embracing them as expected. Instead, threat actors are increasingly using AI to accelerate routine, but operationally significant, tasks to scale their operations. Drafting phishing lures, profiling targets, debugging code, generating forged documents, modifying malware, translating victim communications, and processing stolen data at scale were once time-consuming activities that AI has made significantly easier. AI does not replace cybercriminals; it lowers friction, increases speed, and expands the range of actors able to perform tasks that previously required more time, skill, or external support.
AI is being absorbed into criminal tradecraft, embedding itself in social engineering, fraud enablement, impersonation, identity abuse, and post-breach data exploitation. The market supporting this demand is not a single coherent product category, but a broader ecosystem of jailbreak wrappers, Telegram-based bots, prompt packs, open-weight model deployments, stolen AI accounts, and hijacked API keys. Their importance lies less in technical elegance than in usability. They provide criminals with accessible, repeatable, and commercially packaged ways to apply AI to operational problems.
This ecosystem should not be mistaken for a stable or fully mature criminal market. Compared with more established sectors, criminal AI remains volatile, uneven, and heavily exposed to hype. Some services offer genuine operational utility while others are little more than repackaged public models marketed at inflated prices. Many are short-lived, deceptive, or opportunistic rebrands.
Even so, the demand is real. The core shift is not the arrival of a single dominant criminal model, but the commercialization of access to AI-enabled criminal capability. The strategic significance of criminal AI lies in compressing time, lowering skill barriers, improving communication quality, and scaling existing criminal workflows.
Criminal AI-as-a-Service
The defining features of this market have little to do with any technical novelty, but rather the packaging and monetization of access. By early 2026, many underground services were marketed through familiar commercial mechanisms like subscriptions, private support channels, Telegram-based delivery, gated communities, and promises of uncensored output, privacy, or reduced logging. These are clear signs of SaaS-style commercialization, albeit far less mature or stable than its legitimate counterparts.
The market should be best understood as “Criminal AI-as-a-Service.” Most offerings do not appear to rely on original foundational models built by threat actors. Instead, they typically depend on jailbreaks, wrappers around commercial services, fine-tuned open-weight models, repackaged interfaces, or modular combinations of existing capabilities.
Pricing patterns suggest growing commercialization, but not a stable market structure. Entry-level access may be inexpensive, while premium services can be marketed at significantly higher rates with promises of priority support or additional functionality. These prices should be treated as indicative, not definitive (Figures 1 and 2). They are highly volatile and shaped by takedowns, fraud, rebranding, and shifting demand.
At the lower end, free tools and stolen access to legitimate AI services often remain the default. In the middle of the market, recurring subscriptions are increasingly common. At the upper end, some services claim to use more modular or self-hosted architectures to reduce dependence on mainstream platforms. Together, these patterns point to a market that is becoming more operationalized, even if it remains unstable and hype-driven.
Figure 1: Xanthorox’s pricing
⠀
Figure 2: WormGPT's pricing
Main criminal AI tool families
The criminal AI ecosystem is defined by several distinct tool families that reflect how threat actors adopt, package, and market generative AI for illicit use. Some platforms function as fraud-enabling assistants, others as uncensored Telegram-native chatbots, modular offensive frameworks, or low-barrier tools aimed at novice users. Examining these categories is more useful than focusing solely on individual brand names, as it reveals the market’s underlying operational logic. That logic is based on how these tools are distributed, which users they target, and which stages of the criminal workflow they are designed to support.
Overall, the market is increasingly splitting into two complementary directions. At one end are low-cost, mass-market tools that help less experienced actors produce phishing content, scam scripts, malware prompts, forged material, and social engineering narratives at scale. At the other end are more specialized platforms that integrate AI into execution workflows, supporting targeting, automation, and operational optimization for fewer but more precise attacks. This volume-versus-precision dynamic shows that criminal AI is no longer only about accelerating malicious content generation; it is also becoming a way to make illicit operations more scalable, quieter, and strategically targeted.
FraudGPT
This tool family represents the distribution model for criminal AI by fraud shops. Emerging in mid-2023 for a few hundred dollars per month, its longevity on the black market stems from its positioning as an "all-in-one" operational assistant rather than a simple programming tool. Most buyers are not using it to engineer highly complex malware; instead, they treat it as a productivity engine to orchestrate the entire fraud chain.
Threat actors use it to systematically design lookalike phishing pages, scrape target data, draft convincing spear-phishing lures, and generate scam scripts. Even as the underlying architecture has evolved away from standalone models and toward basic wrappers around legitimate, jailbroken corporate APIs, FraudGPT remains a staple of the underground economy because it effectively democratizes advanced social engineering, allowing entry-level scammers to execute highly localized, grammatically flawless, and high-volume fraud operations (Figure 3).
Figure 3: FraudGPT’s website
⠀
GhostGPT
This tool family reflects the Telegram-native distribution model. Its reported selling points — uncensored output, ease of access, and reduced operational friction — illustrate the convenience and perceived safety many criminal buyers claim to value most. However, like many tools in this category, independent verification of its capabilities is limited, and its significance lies more in what it signals about buyer preferences than in any confirmed technical differentiation.
WormGPT
This tool family serves as the ultimate case study in the power and persistence of criminal branding. While the original, headline-grabbing tool was officially shut down by its creator in August 2023 following intense law enforcement and media exposure, the name has essentially become a generic dark-web trademark for unrestricted AI. The market is saturated with opportunistic copycats, such as "WormGPT v4" and various Telegram bots trading on the name.
Threat intelligence analysis of these modern variants reveals that they share zero code with the original system; instead, they are highly volatile marketing shells, often basic API wrappers around commercial models like Grok or Mixtral that use specialized system prompts to bypass safety guardrails. WormGPT's relevance in 2026 lies not in its technical uniqueness but in its sociological impact. It is an entry-level gateway tool used by script kiddies and sophisticated actors alike to quickly generate functional exploit scripts, craft persuasive business email compromise (BEC) lures, and scale offensive workflows (Figure 4).
Figure 4: WormGPT‘s website
⠀
KawaiiGPT
This is a freely accessible or low-cost criminally oriented AI chatbot/tool marketed in underground spaces to generate or support illicit content and cybercrime-related tasks. Its use highlights the problem of low-barrier access in the criminal LLM market. Its relevance does not lie in any demonstrated advanced capability and there is little evidence that it provides meaningful technical sophistication beyond basic generative AI functions. Rather, KawaiiGPT is important as an example of how free or near-free tools can normalize AI-assisted offending among less experienced users. Its significance is therefore sociological rather than technical as it lowers the threshold for participation, makes AI-assisted offending appear accessible and low-risk, and introduces novice actors to workflows such as phishing text generation, fraud scripting, impersonation, and other forms of low-level cybercrime support.
BruteForceAI
This tool family represents a meaningfully different category from the chatbot-style tools that dominate criminal AI branding. BruteForceAI prioritizes precision over content generation. It integrates large language models for intelligent form analysis and sophisticated multi-threaded attack execution. This distinction matters. The broader trend it reflects is one of attackers making fewer, better-targeted attempts rather than relying on brute volume. AI here is not a content tool. It is an execution layer, and the shift from noisy credential stuffing to quiet, optimized targeting is strategically more significant than any individual tool name (Figure 5).
Figure 5: BruteforceAI program
⠀
Xanthorox
This AI represents the modular criminal AI platform. Its significance lies in how it is marketed. Public reporting describes it as more than another “evil chatbot,” with claims around coding support, multiple model components, and broader operational utility. Still, Xanthorox should be framed cautiously. It is better treated as an emerging or ambitiously marketed platform than as a universally verified flagship of the underground market (Figure 6).
Figure 6: Xanthorox’s website
⠀
The wide variety of smaller adversarial AI tools in 2026, including names like DarkGPT, EscapeGPT, WolfGPT, Evil-GPT, XXXGPT, and BadGPT, should be viewed with caution. These brands do not constitute a coherent or reliable category; instead, they often function as short-lived rebrandings or simple interfaces built on public or open-source models. In many cases, these are "scam-of-the-month" services hosted on Telegram, designed to capitalize on hype, with entry-level memberships starting at a few dozen dollars. However, they should not be dismissed outright, as some do offer genuine un-censorship or serve as testing grounds for malicious exploits. The bottom line in 2026 is that the brand name matters less than the underlying architecture. Most "GPT" labels are disposable marketing shells used to evade takedown measures or rebuild credibility after a service failure.
What truly defines the threat is the infrastructure supporting them. While entry-level tiers cost very little, professional-grade systems can cost thousands of dollars. At this level, the value isn't in the name, but in the technical setup.: These include the specific model used, how the service is delivered, the reliability of the operator, and how well it connects with other criminal tools like phishing kits, stealers, and ransomware support. Ultimately, the market has shifted toward operationalizing AI, focusing on tools that can automate and maximize the efficiency of entire illicit workflows.
Stolen AI accounts as an overlooked criminal market
One of the most important and still underappreciated developments in this landscape is the resale and abuse of legitimate AI access. This pattern is not new. Every widely adopted and commercially valuable technology eventually generates a secondary criminal market around stolen credentials, compromised accounts, and unauthorized access. AI is now following the same trajectory. Threat actors do not rely only on underground “dark AI” tools. They also misuse mainstream AI platforms directly.
However, the abuse of stolen AI accounts and hijacked API keys may be more consequential than many earlier credential markets. Access to legitimate AI services can provide threat actors with scalable cognitive and operational capabilities, not just access to a single platform or dataset. A compromised AI account may enable faster reconnaissance, multilingual targeting, automated content production, code generation, malware troubleshooting, and the refinement of phishing or fraud workflows. Hijacked API keys may also allow actors to consume compute resources at the victim’s expense, bypass usage restrictions tied to their own identities, and access more capable models or enterprise-grade infrastructure. In this sense, stolen AI access is not merely another credential commodity. It can function as an operational force multiplier across multiple stages of the attack lifecycle, making its abuse both expected and potentially more impactful than many traditional forms of account compromise (Figures 7 and 8).
Figure 7: Stolen AI accounts for sale on a cybercrime forum
⠀
Figure 8: More stolen AI accounts for sale on a cybercrime forum
⠀
The impact on organizations can be serious as AI accounts may contain proprietary information such as prompts, uploaded files, source code, legal drafts, customer data, internal summaries, product plans, meeting notes, investigative material, or strategic analysis. If compromised, the exposure extends beyond the credential itself. Enterprise AI accounts and AI-related access tokens should therefore be treated like cloud credentials, developer secrets, email accounts, or administrative SaaS access.
Deepfake services: From impersonation to KYC bypass
Deepfake services have become one of the criminal AI market’s most important adjacent segments, particularly in fraud, synthetic identity creation, onboarding abuse, and KYC bypass. These services are marketed not as experimental technologies, but as practical fraud enablers. Common offerings include face swaps, voice cloning, fake selfie generation, synthetic profiles, document manipulation, virtual camera injection, video-call impersonation, and full onboarding bypass packages (Figure 9). Their significance stems from the fact that many digital platforms continue to rely heavily on remote identity verification and visual trust cues.
The purpose of bypassing KYC controls is to create, validate, or access accounts that should not exist or should not be available to the offender. Once established, such accounts can support money laundering, mule activity, romance scams, investment fraud, payment abuse, sanctions evasion, account resale, and marketplace manipulation. The threat is no longer limited to static fake images. Attackers can combine face swaps, synthetic video, animated media, and virtual camera injection to impersonate real individuals during onboarding or verification.
Deepfake services also strengthen broader fraud operations. Romance scams, fake recruitment schemes, executive impersonation, vendor fraud, and investment scams all become more persuasive when synthetic voice or video is added to the deception chain. These services should therefore be understood as part of the same criminal AI capability stack. LLMs generate scripts, refine pretexts, localize language, and support interaction at scale. Stolen data enhances personalization. Deepfake tools add the visual and audio layer that increases trust and makes deception harder to detect. Together, these capabilities form a more complete deception architecture.
Figure 9: Cybercrime forum's advertisement for a Deepfake KYC bypass service website
Organizational impact and defensive priorities
For organizations, the impact of AI-enabled cybercrime is both economic and operational. The main concern is not the sudden arrival of fully autonomous AI hacking, but the steady increase in attacker productivity, deception quality, operational flexibility, and post-compromise efficiency.
This last concern is important to note. Once attackers obtain data, AI can help them review it more quickly and more systematically. Models can summarize large document sets, identify sensitive or monetizable material, extract victim-specific details, and support tailored extortion or fraud. This does not require a purpose-built criminal model. It requires access to a capable model, relevant data, and a clear criminal objective.
At the same time, enterprise AI environments are becoming part of the attack surface. AI accounts, API keys, prompts, uploaded files, connectors, retrieval systems, internal knowledge bases, and agentic workflows can all expose sensitive business information if they are compromised, misused, or poorly governed. These assets should therefore be managed with the same seriousness as other critical systems, including clear ownership, least-privilege access, logging, monitoring, retention rules, and periodic access reviews.
Organizations should respond by treating criminal AI as a challenge of trust, identity, workflow security, and data governance, rather than only as a malware issue. High-risk business processes should be reinforced with stronger approval controls, transaction verification, segregation of duties, and out-of-band confirmation, especially for financial transfers, access changes, sensitive data requests, and executive communications.
Phishing and fraud defenses must also adapt. Poor grammar and obvious language errors are no longer reliable indicators of malicious activity. Organizations should assume that many adversaries can now generate polished, localized, and credible communications at scale. Detection should therefore rely more heavily on behavioral indicators, sender validation, process anomalies, identity verification, and transaction integrity than on superficial language cues.
At the same time, organizations should prepare for AI-assisted post-breach exploitation by improving data minimization, segmentation, access controls, monitoring, logging, and incident response planning. They should also monitor the broader underground capability stack, including jailbreak services, stolen AI accounts, and synthetic media tooling, because these increasingly shape attacker tradecraft in practice.
The market will likely see more bundling of text generation, translation, impersonation, data analysis, and synthetic media into a single criminal offering. It will also likely see continued abuse of legitimate AI platforms alongside wrapper-based underground services. The ecosystem will likely remain uneven, opportunistic, and hype-heavy, while becoming strategically important because it makes cybercrime easier to execute, scale, and detectFor organizations, the main risk is not only higher financial loss, but also the growing operational strain created by AI-assisted attacks that are faster, more scalable, and harder to triage.
Enterprise AI accounts, API keys, prompts, uploaded files, connectors, retrieval systems, internal knowledge bases, and agentic workflows should be managed as critical assets, with clear ownership, least-privilege access, logging, monitoring, retention rules, and periodic access reviews. Sensitive data should be exposed to AI systems only when there is a clear business need, especially when AI tools connect to email, cloud storage, code repositories, customer databases, financial systems, or external services. High-risk AI connectors and workflows should be inventoried, risk-ranked, and monitored for abnormal access, bulk data movement, privilege escalation, or unauthorized agent actions.
As phishing tactics become better, core controls should include MFA, phishing-resistant authentication, conditional access, DLP, EDR/XDR, API security monitoring, secrets scanning, prompt and output filtering, and model-access controls. Incident response plans should also cover stolen AI accounts, exposed prompts, compromised API keys, leaked embeddings, abused connectors, and sensitive data retained in AI workspaces.
The organizations best positioned for the next phase will be those that integrate AI risk into existing security governance rather than treating it as a separate technical issue. As criminal use of AI becomes part of everyday attacker tradecraft, resilience will depend on the ability to verify identity, control access, protect data flows, monitor AI-enabled workflows, and maintain human oversight over high-impact decisions. The future defensive priority is therefore not to predict every AI-enabled attack, but to build security architectures that remain reliable when attackers become faster, more persuasive, and more efficient.
Login
