WormGPT malicious LLM surfaces on hacker forums

WormGPT, a large language model built on the older, open-source GPT-J architecture from 2021 and fine-tuned on malware-development material, began circulating for sale on underground hacker forums including Hack Forums and the Exploit forum around July 2023, advertised by a pseudonymous developer using the handle “last/laste.” Access was priced at €60 to €100 a month or €550 a year, with a premium version and private custom builds available for a few thousand euros more. The anti-phishing firm SlashNext, which obtained access through the same forum, published the first widely cited technical analysis in mid-July.

Unlike mainstream chatbots, WormGPT was marketed explicitly on the basis that it carried no ethical guardrails and would answer requests that ChatGPT and similar tools were designed to refuse. Security researchers who tested it reported it could generate functional malware code and write convincing phishing emails impersonating company executives — the kind of message used in business email compromise fraud, where an attacker poses as a senior colleague to authorise a wire transfer. Analysts also noted that mainstream models could be coaxed into producing comparable output with carefully worded prompts; WormGPT’s contribution was removing that friction entirely and packaging it as a commercial service.

WormGPT was widely covered as one of the first purpose-built “uncensored” LLM products aimed squarely at cybercrime, rather than a jailbroken version of an existing consumer chatbot. Its developer reportedly shut the project down the following month after the media attention it drew, but similar tools — including FraudGPT, advertised on Telegram and the dark web around the same time — followed the same template, establishing a small but persistent market in stripped-down, guardrail-free models sold specifically for fraud and phishing.