The AI Toolbox for Criminals: How Large Language Models Are Reshaping Cybercrime

The same AI tools being used to write business emails and debug code are now helping criminals build malware, run phishing campaigns at industrial scale, and conduct attacks that once required entire teams. This is not a future risk. It is already happening.

In February 2025, three teenagers with no coding background used an AI chatbot to build an automated attack tool that hammered a major mobile carrier’s systems roughly 220,000 times. They spent the proceeds on gaming consoles. Five months later, a single person used an AI coding agent to run an extortion campaign against 17 organizations over one month, using the AI to write malicious code, sort stolen files, analyze financial records to calibrate ransom demands, and draft the extortion emails themselves. Neither operation required a professional criminal organization. Neither required deep technical expertise. Both required AI.

These cases are not outliers. They represent the leading edge of a shift that security researchers have been tracking since large language models became widely accessible. For decades, serious cyberattacks required serious skills: knowledge of programming languages, operating systems, network protocols, and evasion techniques. Building a functional piece of malware from scratch took weeks of specialized work. Running a convincing phishing operation at scale required teams of writers, translators, and developers. AI has dismantled those requirements one by one.

Anyone Can Write Malware Now

The technical barrier to creating malicious software has dropped sharply. Modern language models can produce functional PowerShell scripts, Python attack tools, JavaScript droppers, Visual Basic macros, and Windows API interaction code in seconds. While reputable AI systems include safeguards, criminals have found multiple ways around them, including jailbreaking commercial models, fine-tuning open-source alternatives with fewer restrictions, or using criminal-market tools built specifically for this purpose.

The underground market has responded to this demand. Tools like WormGPT and FraudGPT are specifically designed, promoted, and sold to criminals in dark web forums. WormGPT is built on an open-source language model and trained on malware-related data. It has been used to write phishing emails, generate polymorphic malware, and craft business email compromise messages. Research from Cato Networks found new WormGPT variants built on top of commercial models including Grok and Mixtral, offered via subscription for as little as €60 per month. These are not standalone creations. They are mainstream AI models with their safety features stripped out and their prompts tuned for criminal use.

For malware developers already working in this space, AI serves as an accelerator. Instead of spending days researching Windows internals, persistence mechanisms, or network communication protocols, a developer can generate a working foundation and modify it for their specific operation. This compresses development cycles dramatically and allows for much more rapid experimentation with new techniques.

Phishing That Actually Works

Before AI, phishing emails were easy to spot if you knew what to look for. Awkward grammar, generic greetings, mistranslations, and implausible scenarios gave them away. Security awareness training was built around teaching people to notice these signals. That playbook is now significantly less reliable.

Language models produce professionally written text by default. Criminals can generate phishing messages that read exactly like internal company communications, match the tone and vocabulary of specific industries, and incorporate details scraped from public sources including LinkedIn profiles, corporate websites, press releases, and previously breached data. A target might receive a message that references a real colleague by name, mentions an ongoing project, and uses the company’s actual internal formatting conventions. Everbridge’s 2026 threat analysis confirmed that in 2025, AI-generated phishing began outperforming human red teams entirely in terms of click-through rates.

The personalization that used to define high-value spear-phishing campaigns targeting executives is now available at scale. What required a dedicated analyst and hours of research per target can be automated across thousands of victims simultaneously.

Malware That Thinks for Itself Mid-Attack

Perhaps the most technically significant development documented in recent research is the emergence of malware that actively queries language models during execution, not just at the design stage.

Google’s Threat Intelligence Group identified two malware families, PROMPTFLUX and PROMPTSTEAL, that call out to language models mid-execution to adapt their behavior and evade detection in real time. Rather than containing fixed logic that can be analyzed and blocked, these tools generate new code or instructions on the fly based on the environment they find themselves in. This is a qualitatively different challenge for defenders compared to traditional malware.

Mandiant’s M-Trends 2026 report also documented QUIETVAULT, a credential stealer that checks targeted machines for local AI command-line tools and then executes predefined prompts to search for configuration files and credentials. The malware is using AI as a search and analysis layer within the victim’s own environment.

Traditional malware families often remained relatively stable because rewriting them took substantial effort. AI-assisted development changes that. A developer can generate many versions of the same tool while varying the code structure, variable names, execution sequence, and communication methods. Each variant may perform identical functions but look completely different to a detection system. Security vendors have increasingly observed malicious scripts with coding patterns inconsistent with human-authored malware, characterized by unusual stylistic mixing and structural choices that reflect AI generation rather than a single developer’s habits.

Building an Entire Fake Worldcybersecurity

Running a successful cyberattack involves more than writing malicious code. Attackers need convincing websites to host phishing pages, realistic login portals to harvest credentials, fake organizations to establish apparent legitimacy, social media content to build trust, and technical documentation to support their tools. All of these components used to require teams with different skill sets.

Generative AI removes that requirement. A single operator can now produce a convincing fake website impersonating a government agency or financial institution, complete with a realistic privacy policy, customer support pages, and frequently asked questions. They can create a fake company’s social media presence, write job postings that establish credibility, and generate realistic email threads to support a long-running social engineering campaign. The graphic designers, translators, content writers, and web developers that a well-resourced criminal operation once required have been replaced by a prompt.

IIT Kanpur researchers who systematically tested ChatGPT and Google’s Bard for their ability to generate MITRE-mapped attack payloads found that these tools could produce implementable code for the ten most commonly observed attack techniques. They concluded that LLMs provide amateur attackers with substantially expanded capabilities and specifically benefit ransomware operators seeking to generate sophisticated variants quickly.

Conversations That Never End and Always Adapt

Traditional social engineering relied on a single touchpoint. A victim received a message, either they clicked or they did not. AI opens a different model: multi-turn attacks that unfold over days or weeks through ongoing conversations.

An attacker can deploy an AI that maintains an extended email, chat, or messaging exchange with a target, adapting its language and approach based on responses. The conversation can be designed to gradually build trust, establish context, and eventually ask for the one thing the attacker actually needs: a credential, a document, a wire transfer, or a click on a link. Because the AI responds naturally to whatever the victim says, the interaction feels genuine in a way that a pre-scripted template never could.

Researchers describe this development as one of the harder challenges for security awareness training to address, because it asks people to remain suspicious of conversations that appear entirely normal and responsive throughout their entire duration.

Attribution Is Getting Harder

Security researchers have traditionally traced attacks back to specific groups by analyzing shared coding patterns, infrastructure reuse, language artifacts in code and documents, and operational habits that persist across campaigns. AI generation is eroding several of these signals simultaneously.

When multiple different threat groups use the same underlying language model, their output can look increasingly similar even if the groups have no connection to each other. At the same time, a single attacker can generate malware that appears completely different from one campaign to the next, simply by prompting the model to use a different structure, language, or coding style. The fingerprint that a human developer leaves across their work, through consistent choices in how they name variables, handle errors, or structure functions, is absent from AI-generated code or deliberately randomized.

Research published on arXiv examining uncensored language models found 173 confirmed models operating as backends for criminal services, derived from 98 open-source base models. As these tools proliferate and criminal operators mix and match them, the task of reliably tracing an attack back to a specific group becomes substantially more difficult.

What All This Means for Defenders

The long-term concern is not that AI will replace cybercriminals. It is that AI will make criminals far more scalable. A small team with access to the right tools can now manage campaigns of a size and complexity that previously required entire organizations. Mandiant’s observation that the median time from initial access to handoff between threat groups collapsed from eight hours to 22 seconds between 2022 and 2025 captures what this acceleration looks like in practice. The operational tempo of attacks has fundamentally changed.

Google Threat Intelligence Group describes AI as having moved from being a productivity tool that attackers used occasionally to a component embedded across the full attack lifecycle, from reconnaissance and social engineering through malware development, infrastructure management, and data analysis after a breach. Trend Micro frames the shift as the difference between cybercriminals building their weapons and renting them. When the weapon can be rented by anyone at €60 per month and arrives ready to deploy, the population of people capable of conducting a serious cyberattack expands dramatically.

References

Industry threat reports

Academic research

This article is provided for informational and educational purposes. The named malware families PROMPTFLUX, PROMPTSTEAL, and QUIETVAULT are documented in publicly released Mandiant and Google Threat Intelligence Group research. Criminal LLM tools including WormGPT and FraudGPT are documented in published industry and academic reporting. The real-world attack cases cited are sourced from The Hacker News and Rapid7.