{"id":14354,"date":"2025-06-30T08:33:32","date_gmt":"2025-06-30T08:33:32","guid":{"rendered":"https:\/\/newestek.com\/?p=14354"},"modified":"2025-06-30T08:33:32","modified_gmt":"2025-06-30T08:33:32","slug":"cybercriminals-take-malicious-ai-to-the-next-level","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=14354","title":{"rendered":"Cybercriminals take malicious AI to the next level"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Cybercriminals have begun refining malicious large language models (LLMs) using underground forum posts and breach dumps to tailor AI models for specific fraud schemes, threat intel firm Flashpoint warns.<\/p>\n

More specifically, fraudsters are fine-tuning illicit LLMs \u2014 including WormGPT<\/a> and FraudGPT \u2014 using malicious datasets such as breached credentials, scam scripts, and infostealer logs. As adversaries use these models to generate outputs, they gather user feedback to fine-tune responses, creating a loop where offensive capability keeps improving over time.<\/p>\n

[ See also: Top 5 ways attackers use generative AI to exploit your systems<\/a> ]<\/strong><\/p>\n

\u201cThis trend is particularly concerning because it demonstrates adversaries \u2018closing the loop on model tuning\u2019 \u2014 their offensive capabilities constantly improving over time through real-time feedback and illicit data,\u201d Ian Gray, Flashpoint VP of cyber threat intelligence, tells CSO.<\/p>\n

Flashpoint has also observed private chat groups where users submitted failed prompt attempts back to LLM developers, leading to rapid iteration and improved performance within days. In one instance, a user reported formatting issues with a financial fraud prompt, and shortly after, the developer shared an updated version with refined templates, Flashpoint observed.<\/p>\n

\u201cThis adaptive and self-improving nature of malicious AI, fueled by compromised data and criminal collaboration, makes it an especially potent and difficult threat to counter,\u201d Gray says.<\/p>\n

Cybercriminals are tailoring AI models for specific fraud schemes, including generating phishing emails<\/a> tailored by sector or language, as well as writing fake job posts, invoices, or verification prompts.<\/p>\n

\u201cSome vendors even market these tools with tiered pricing, API access, and private key licensing, mirroring the [legitimate] SaaS economy,\u201d Flashpoint researchers found.<\/p>\n

\u201cThis specialization leads to potentially greater success rates and automated complex attack stages,\u201d Flashpoint\u2019s Gray tells CSO.<\/p>\n

Deepfake as a service goes mainstream<\/h2>\n

Cybercrime vendors are also lowering the barrier for creating synthetic video and voice, with deepfake as a service (DaaS) offerings that include:<\/p>\n