The Criminal AI Toolbox

It's worth starting with a distinction that is often overlooked, as it changes the way we defend ourselves. One thing is AI used as a weapon, meaning models and agents that help the attacker write phishing, generate malware, or conduct a campaign autonomously. Another is attacks aimed at AI systems, for example, deceiving facial recognition or poisoning a model. MITRE ATLAS, the reference taxonomy, mainly catalogs the latter family. Many of the tools below fall into the former and are documented by researchers and security vendors rather than ATLAS: stating this clearly avoids attributing an official identifier to something that doesn't have one.

Deepfake and Identity Fraud

This is the category where the two families meet, and also the one best anchored to ATLAS. The most concrete case is ProKYC, a tool sold ready-made to criminals that generates fake identity documents and deepfake video selfies to pass the KYC verification of banks and cryptocurrency exchanges. MITRE ATLAS catalogs it as AML.CS0034, alongside the iProov Red Team case, AML.CS0033, where a real-time injected deepfake bypasses facial recognition and liveness checks. The basic technique, synthetic face generation, corresponds to the entry Generate Deepfakes (AML.T0088). We discussed this extensively in the dossier on deepfake bypassing KYC.

LLMs Without Guardrails

Since mid-2023, private language models have appeared on criminal forums, stripped of any ethical filters and sold by subscription to write convincing phishing emails, romance scam texts, and carding scripts. The first known to researchers were WormGPT and FraudGPT; from there, a long series of clones with similar names emerged, up to the most recent like GhostGPT. An honest point must be made: this market is full of smoke. Several of these offerings turned out to be scams themselves aimed at aspiring criminals, and some projects closed shortly after becoming famous. However, they remain a signal of real demand and the reason why security filters on legitimate models truly matter.

Malware Writing Its Own Commands with AI

Here, AI enters the malicious code. MITRE ATLAS documents LAMEHUG (AML.CS0044), malware that, at execution time, asks a language model to generate the commands to run on the infected machine, instead of carrying them already written within it. It's the same principle that ATLAS calls Generate Malicious Commands (AML.T0102), and it shifts the malware towards behavior more difficult to recognize with classic signatures, as the commands change each time.

Autonomous Offensive Agents

The next step is to delegate the entire attack chain to an agent. Unit 42 documented a case where an attacker launched over 460 targets using an agent based on DeepSeek, with just one message: reconnaissance, exploit search, and exploitation attempt conducted without supervision step by step. In ATLAS, the behavior is read through the entries Deploy AI Agent (AML.T0103) and AI Agent (AML.T0108). The full story is in the dossier on the autonomous agent.

Phishing and Credential Theft on Demand

Around these tools revolves an economy of services that doesn't always use AI but is its natural complement. On one side, phishing-as-a-service kits capable of stealing even the authenticated session bypassing the second factor, with names like EvilProxy, Tycoon 2FA, and LabHost. On the other, infostealers sold by subscription, like RedLine, LummaC2, and StealC, which collect passwords, cookies, and wallets from infected devices. They are the raw material for most frauds: the stolen credentials here become the starting point to open accounts or empty them. Several of these services have been hit by international police operations, which shows how significant they are in the real picture.

How to Defend

The common thread of defense doesn't change with AI; it just moves higher. Against deepfakes on KYC, it's necessary to verify the video's origin, not just the face, with device attestation and challenge-response. Against credential theft and phishing with MFA bypass, solid countermeasures are passkeys, which eliminate the stealable secret. Against malware and agents generating commands on the fly, it's necessary to observe what a process or agent actually executes, not just how the file is made, and to be able to block the action before it hits. This is exactly the principle we test defensively within TCT, and on which our Red Team Simulator is built.

The AML.CSxxxx and AML.Txxxx identifiers mentioned belong to the public MITRE ATLAS matrix and are verifiable on the official site. Tools without them are documented by researchers and security vendors and remain outside the ATLAS perimeter because they use AI to attack, rather than attacking AI itself.