Cybercriminal abuse of large language models
Summary: Cisco Talos reports that cybercriminals are turning to uncensored models such as Llama 2 Uncensored via the Ollama framework and WhiteRabbitNeo, or to criminal-built LLMs including GhostGPT, WormGPT, DarkGPT, DarkestGPT and FraudGPT, to get around the alignment training and guardrails that make frontier models refuse harmful requests. Talos also found that FraudGPT's seller, CanadianKingpin12, took cryptocurrency from would-be buyers without delivering working access, and that attackers plant malicious Python code in pickle files on Hugging Face models and poison Retrieval Augmented Generation data sources.
What's compelling: Talos describes LLMs not as new weapons but as a force multiplier for familiar attacks, and the same model files your teams download and run can carry attacker code through the pickle deserialization process.
Read the original at Cisco Talos ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026