# The 10 Most Dangerous "DARK WEB AI" Tools Still Operating Right Now?

Channel: Electronic Tech Show
Video: https://www.youtube.com/watch?v=QnD7nT9OWjI
Duration: 14 min
Language: English
Words: 2464
Transcript page: https://viewrankai.com/tools/youtube-transcript/QnD7nT9OWjI

---

[0:00] This script finds every PDF on a Windows computer and encrypts it. And this note gives the owner 72 hours to pay before the price doubles. A criminal chatbot wrote both the moment researchers at Palo Alto Networks asked it to. Lifetime access costs $220. I went through the threat reports on tools like this and kept the 10 with the freshest evidence that they're still being sold, shared, or used. And for each one, you'll see what researchers actually got out of it, where it falls

[0:25] short, and how you stop what it makes. One needs no account at all, only the Tor browser. One hides inside Russian state malware and asks an AI what to type next. One was sold as the killer of all the others. And Trend Micro's testing points to Google's Gemini running underneath. And one reads every prompt its own customers send. Halcyon, a ransomware research team, counted underground posts mentioning these tools on Telegram channels and dark web forums. And they went from 38 in December to 1,486 two months later. The one that wrote

[0:57] that ransom note is number one. This video is for educational purposes only. So, use what you learn responsibly and only on systems you own or have written permission to test. Don't forget to subscribe my channel and watch the video till the end. So, let's get into the video soon. [music]

[1:21] Number 10 is for anyone who's ever signed a document by email. Ghost GPT is a chatbot built for criminals and it's sold through Telegram. Remember that word because most of this list lives on Telegram and ordinary websites. And the dark web is the smaller part of it. Abnormal Security, an email security company, found Ghost GPT and asked it for a DocuSign phishing email. It produced a convincing template with ease. Abnormal says it likely connects to a jailbroken version of ChatGPT or an open-source model with the safety filters stripped out. It sells itself on a no-logs policy, so the buyer has nothing to set

[1:58] up and leaves less of a trail. In its 2026 report, Halcyon still lists Ghost GPT among the named tools that appear regularly in circulation. Its weak spot is that a wrapper like this is only as good as the model behind it. And Abnormal could only guess which one that is. A fake DocuSign email also has to send you somewhere to do any harm. So when a document lands in your inbox, open DocuSign by typing the address yourself. And never type a password on a

[2:23] page an email took you to. Number nine is aimed at your wallet, and it was the first criminal chatbot sold by Recorded Future software. In July 2023, Recorded Future researcher Rakesh Krishnan found Fraud GPT advertised on dark web marketplaces and Telegram. Krishnan described it like this, "This is an AI bot exclusively targeted for offensive purposes, such as crafting spear phishing emails, creating cracking tools, carding, etc." It came on a subscription at $200 a month, $1,000 for

[2:53] 6 months, or $1,700 for a year. That business model stuck, and Halcyon's 2026 data still lists Fraud GPT as appearing regularly. Later in this list, you'll see how far the copycats have cut the price. As for limits, I couldn't find a single published test of what Fraud GPT can actually do, so the sales pitch is all anyone has, and criminal sellers lie to their customers, too. Carding means using stolen card numbers, and you can

[3:17] act on that one today. Turn on purchase alerts for every card you own, so a charge you didn't make reaches your phone within seconds. Number eight is malware that asks an AI what to do on your computer while you play with an image generator. In July 2025, Ukraine's cyber response team, CERT-UA, reported emails carrying a zip file. Inside was a program that pretends to generate images. While the victim plays with it, it asks an AI model on Hugging Face Qwen 2.5 Coder to write Windows commands, and then runs them. Google's threat team calls it Prompt Stealer, and ties it to the

[3:50] Russian government-backed group APT28. The prompts sit right in the code. One starts, "Make a list of commands to create folder." and asks for hardware, process, and network information. Another asks to copy Office and PDF documents from documents, downloads, and desktop. Google called it their first observation of malware querying an LLM deployed in live operations. Its weakness is the hugging face token it needs to work. Trend Micro points out that once the AI company spots the abuse, it revokes the key, which works like a kill switch. That same weakness makes it easy to hunt since malware like this has to carry an API address and a key. So, I wrote a Yara rule that flags

[4:28] any file holding both. My lab folder holds a backup script, an update checker, and a harmless test file I built with the same shape. The scan passed the first two and flagged the test file, the only one carrying a key. Packed programs can hide those strings, so this is one layer of defense and a

[4:45] useful one. Number seven is the one from the start that needs no account, and it really does live on the dark web. Resecurity's analysts spotted Dig AI in September 2025, and one line in their write-up explains its pull. Dig AI doesn't require an account and can be accessed via the Tor browser in just a few clicks. Its use climbed through the last months of the year and picked up

[5:06] speed over the winter holidays. Resecurity tested it with their own lists of banned topics and got answers on explosives and drugs, fraud content, and scripts to backdoor vulnerable websites. Its operator claims it runs on something called Chat GPT Turbo, which Resecurity couldn't confirm. Heavier jobs, like obfuscating big blocks of code, took 3 to 5 minutes, and that points to limited computing power behind it. A tool with no account, run by a stranger on Tor, also gives its users no idea who's reading their questions. If you run a website, the backdoor scripts are your

[5:38] problem. Keep its plugins and software updated and set an alert for any new admin account or file you didn't add. Number six decides whether a fake bank email lands in your inbox or your spam folder. Verona's found Spam GPT advertised on underground forums, and it works like a spam company in a box. An AI assistant writes the fishing email for you. Next to it sit tools that check stolen mail server logins, test which inboxes a message lands in, and rotate between servers. The sales pitch promises guaranteed inbox delivery for Gmail, Outlook, Yahoo, and Microsoft 365. Verona's didn't test it. So, guaranteed delivery is only the seller's

[6:17] claim. The same report says this kind of spoofing works best against domains without strict email authentication, and checking yours takes 10 seconds. In my lab, a DMARC lookup shows PayPal's record says P equals reject, which tells mail servers to refuse any message that fakes PayPal's exact address and fails the check. Microsoft's record says the same thing. If you run a domain for your business, look up your own. No record at all, or P equals none, means nothing tells inboxes to refuse email that

[6:45] pretends to come from you. Look-alike domains get around it, so the sender's address still deserves a second look. Number five, called itself the killer of Worm GPT and all evil GPT variants. Zantharox was advertised openly in 2025, sold from its own website for $300 a month, payable only in crypto, with a $2,500 yearly package on top. It pitched privacy with its own models built from scratch and hosted on its own servers, so no big AI company could see what you asked. Trend Micro's researchers tested it the way a criminal would. It did write a working shell code runner, code built to load and launch an attack

[7:21] payload in memory. Then they asked what it runs on, and it said Google Gemini Pro. It reported a window of 72,000 tokens, which matches Gemini Pro 1.0. So, the private homegrown model most likely sits on Google's servers, where its use is likely to be monitored. Trend wrote that Zantharox fell short of the capabilities advertised on its website, and of what a cybercriminal might reasonably expect. Defenders shouldn't relax since the same report warns that criminals are resourceful and should not be underestimated. A working shellcode runner is a real thing to catch. An endpoint protection that watches what a program does after it starts catches

[7:55] what a list of known files misses. Number four costs nothing and Unit 42 at Palo Alto Networks says it usually takes less than 5 minutes to set up on Linux. Kawaii GPT is a free malicious chatbot on GitHub and its slogan is where cuteness meets cyber offense. Its maker claims over 500 registered users with

[8:15] several hundred using it every week. Unit 42 asked it for a spear phishing email from a fake bank. It wrote one instantly with a link to a fake page that asks for card details and date of birth. It also wrote a Python script that hops from one machine to the next over SSH, a script to send stolen files out and a

[8:33] ransom note with Bitcoin instructions. Unit 42 says the hopping script doesn't introduce hugely novel capabilities and Trend Micro found no custom model inside. Kawaii GPT is a wrapper that calls Deep Seek, Gemini and Kimmy. So every request leaves through someone else's API and each of them can cut it off. The hopping script logs in as a real user and that's where you stop it. Use a unique password on every machine or SSH keys with password login switched off and that script stalls at the first

[9:03] door. Number three is the one that reads every prompt its own customer send and if you code with AI that includes source code. Opta's researchers found over half a dozen services on underground forums and chat apps selling cheap access to top AI models. One is called Poison Claude and it claims to sell four of Anthropic's Claude models at 5 to 15% of the

[9:24] official price. It runs on free credit. It farms sign up bonuses like the $100 Amazon gives new Bedrock accounts. Pools those accounts and routes each customer's request through them. A A on its own server showed 881 users and 872 of them were active. Octo thinks many buyers are people shut out of these models in their own country. Every one of them hands their prompts to a stranger. Octo says the service provider has full visibility into prompts and

[9:51] could accidentally leak or sell data. Customers point their coding assistant at it so their code goes along, too. And the access can disappear without notice once the AI company shuts down the farmed accounts. If you use AI at work, never paste company code into a cut price AI service. Put spending caps and alerts on your own API keys so a stolen key shows up as an alert before

[10:12] it shows up as a bill. Number two isn't sold anywhere. ThreatDown, the business security arm of Malwarebytes, went looking on Hugging Face for models with labels like obliterated, uncensored, and heretic. Those labels suggest someone changed the model so it stops refusing harmful requests. And ThreatDown found over 6,000 of them. I counted again in my lab with Hugging

[10:34] Face's own API and the same five labels. It found 21,089 unique models with 52.7 million downloads in the last 30 days. ThreatDown's warning is about where they run. Once they run locally, they leave nothing to monitor, log, intercept, or restrict. [music] There's no Telegram channel to watch and no account to ban. A label only tells you what the uploader claims and my count includes every model with one of those words anywhere in its name. So, it shows how many exist and says nothing about how many were used for crime. For defenders, the tool is invisible so the watching moves to the target. Alerts on a new inbox rule, a new device, or login

[11:12] from somewhere new catch what the attacker does after the click. Number one wrote the PDF locker and the 72-hour ransom note you saw at the start and its name started all of this. The original WormGPT went on sale in 2023. Brian Krebs named its creator, a 23-year-old programmer in Portugal, and after the media attention, he shut the

[11:31] project down. The name outlived the project because copycats took over the brand. Unit 42 tested a recent one, WormGPT-4, on sale in late 2025 for $50 a month or 220 for life. Unit 42 called that ransomware code rudimentary. Halcyon then tracked the most active WormGPT site, priced like any software company, from $9.99 a

[11:53] month for basic up to $500 for lifetime. With 15,283 subscribers on its official Telegram channel, then one of the WormGPT sites got breached. Over 19,000 user records with emails and payment data were dumped on the same hacker forums where the tool was sold. In Halcyon's words, "The tools built to victimize others are now victimizing the

[12:14] people who buy them." Trend Micro adds that the chance that any of these newer services share DNA with the original is vanishingly small. The defense comes from Unit 42's own warning. Defenders can no longer rely on the classic warning signs of poor grammar or sloppy coding. [music] So, when an email asks for money or a login, check it on a second channel and call the person on a number you already

[12:34] have. So, which of the 10 are still operating right now? Seven show up in 2026 reports. WormGPT, KawaiiGPT, the uncensored models, the gray market for AI access, GhostGPT, FraudGPT, and Zantharox. Dig AI, SpamGPT, and Prompt Steal were last reported in 2025, which is about as current as anyone confirms a criminal tool. Put the 10 side by side and almost none of them built their own

[13:02] AI. They rent it, steal it, or wrap it. Most of them sell through Telegram and ordinary websites, and fishing shows up in most of them. So, this week, add a passkey to your main email account, the one every password reset goes through. A fake login page has nothing to catch when there's no password to type. If you want to know the seven free GitHub projects that make life hardest for the FBI, click on this video and I will see

[13:25] you there.

---

About this transcript
Read from YouTube's own caption track and laid out by ViewRank AI (https://viewrankai.com).
ViewRank AI finds the videos already beating a creator's own average on Instagram, TikTok and YouTube Shorts, transcribes them from the audio itself in more than 60 languages, and turns what worked into new ideas and scripts.
Free transcript tools, no account needed: https://viewrankai.com/tools
How to read any video this way: https://viewrankai.com/llms.txt