Malicious AI chatbots sold on dark web enable unskilled hackers to create malware
Malicious AI chatbots WormGPT 4 and KawaiiGPT have been made available to cybercriminals, with the former sold for as little as $220 for lifetime access and the latter offered free. These tools remove ethical restrictions to enable unskilled attackers to generate ransomware, phishing emails, and other malicious code.
What happened
WormGPT 4, a malicious LLM built on the open-source GPT-J 6B model and trained on malware code and exploit guides, returned to circulation around September 27, 2025, with transparent pricing: $50 monthly, $175 annually, or $220 for lifetime access. The tool attracted over 500 Telegram subscribers.
KawaiiGPT, a free alternative launched in July 2025 and available on GitHub, can be deployed on Linux systems in under five minutes. Both tools remove ethical restrictions found in mainstream AI models, enabling users to generate phishing emails, ransomware scripts, and data exfiltration code with minimal technical skill.
Reported impact
Unit 42 researchers confirmed that WormGPT 4 can instantly generate functional ransomware scripts using AES-256 encryption with command-and-control server support, and create professional ransom notes. KawaiiGPT can produce convincing spear-phishing emails appearing to come from banks, Python scripts for lateral network movement, and code targeting email file exfiltration.
Index analysis
The availability of these tools at low cost or free lowers cybercrime entry barriers for unskilled attackers. Large language models present a challenge for security professionals because the same capabilities useful for defense can be powerful for attacks, and the distinction between research tools and weapons often depends only on user intent.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.