‘FraudGPT’: A New AI Weapon for Advanced and Elusive Cyber Offenses

Usama AnjumLast Updated: Jul 27, 2023

With the advent of generative AI, threat actors have also found new ways to proliferate their malicious networks. Initially, we witnessed WormGPT which hackers were using to target users. Now, a source entailed that a group of hackers is advertising yet another malicious generative artificial intelligence (AI) tool known as FraudGPT on several dark web marketplaces and Telegram channels. According to the source, the hackers have been offering a subscription cost of $200 per month and $1,000 per 6 months and $1,700 per year.

In this regard, security researcher Rakesh Krishan in a report said,

This is an AI bot, exclusively targeted for offensive purposes, such as crafting spear phishing emails, creating cracking tools, carding, etc.

Moreover, it is stated that the FraudGPT has the potential to write malicious code, build undetectable malware, and discover vulnerabilities in a certain program. The source suggests that over 3,000 confirmed sales and reviews of the malicious generative AI have already been made. However, the exact extensive language model (LLM) that was utilized to develop this malicious tool is currently unknown.

An actor, known online as CanadianKingpin said,

If your [sic] looking for a Chat GPT alternative designed to provide a wide range of exclusive tools, features, and capabilities tailored to anyone’s individuals with no boundaries then look no further.

Besides taking the new tools to carry out advanced malicious attacks by seasoned hackers, it could act as a launchpad for new actors. They can execute widespread phishing and business email compromise attacks, leading to the theft of sensitive data.

Krishan further said,

While organizations can create ChatGPT (and other tools) with ethical safeguards, it isn’t a difficult feat to reimplement the same technology without those safeguards. Implementing a defense-in-depth strategy with all the security telemetry available for fast analytics has become all the more essential to finding these fast-moving threats before a phishing email can turn into ransomware or data exfiltration.