MessiahGPT AI Tool Generates Ransomware and Phishing Kits

Key Takeaways

• A new criminal AI service, MessiahGPT, is openly advertised on BreachForums, offering to generate ransomware, phishing kits, and other malicious tools.
• Unlike jailbroken public models, MessiahGPT claims to be custom-trained without ethical constraints, using a corpus of dark web data and unfiltered internet scrapes.
• The service provides 50 free queries and affordable paid plans (starting at ~$8/month), making advanced cybercrime capabilities accessible to low-skilled actors.
• MessiahGPT and similar services like DarkGPT signify a growing trend of commercialized, uncensored AI-as-a-service in the cybercriminal underground.
• Defenders must adapt to an expected increase in AI-generated, highly varied attacks, emphasizing behavioral detection, robust identity controls, and continuous user awareness.

MessiahGPT: A New AI Threat Generates Ransomware and Phishing Kits

A sophisticated new artificial intelligence platform, dubbed MessiahGPT, has emerged on prominent cybercrime forums, openly marketing its capabilities to generate a range of offensive tools including ransomware, phishing kits, data stealers, crypters, and rootkits. This development, detailed in research by the Trellix Advanced Research Center, signals a concerning leap in the accessibility of advanced cybercrime tools.

MessiahGPT operates via a live platform at messiahgpt[.]de and maintains an active community on Telegram. Its operators are transparent about their target audience, explicitly catering to individuals seeking to engage in illicit cyber activities.

Unconstrained AI: A Purpose-Built Malicious Model

What distinguishes MessiahGPT from the numerous “jailbroken” prompts circulating in underground channels is its foundational claim: the model was not adapted from an existing ethical AI but rather trained from the ground up. Its creators assert that MessiahGPT was developed with “zero ethical constraints,” bypassing standard safeguards such as Reinforcement Learning from Human Feedback (RLHF), Constitutional AI layers, or any inherent concept of harm or illegality.

The advertised training data for MessiahGPT reportedly comprises content typically filtered out by mainstream AI developers, including unrestricted manuals, archives from the dark web, leaked documentation, and raw internet scrapes, all without post-filtering. This unfiltered corpus is designed to enable the model to produce malicious output without hesitation.

The platform’s technical architecture is described as a Mixture-of-Experts (MoE) design featuring 128 experts, with 16 active per token. While external verification of these specific technical claims is impossible, researchers confirm that MessiahGPT is a live, accessible service actively promoted on high-traffic criminal forums, validating its operational status.

Low Barrier to Entry Fuels Cybercrime

MessiahGPT’s commercial model is designed for maximum accessibility and minimal friction. It offers 50 free queries without requiring any registration, allowing potential buyers to evaluate the quality of its output before committing financially. Paid subscriptions are remarkably affordable, starting at approximately $8 per month, payable exclusively in cryptocurrency with no Know Your Customer (KYC) checks.

This low price point is significant. For less than the cost of a typical streaming service subscription, even low-skilled actors can reportedly gain access to a tool capable of producing complete, compilable malware and ready-to-deploy phishing kits. Such capabilities previously necessitated either genuine development expertise or established relationships with malware-as-a-service vendors, effectively democratizing advanced cybercrime.

The advertised use cases are alarmingly explicit, extending beyond ransomware and phishing to include social engineering scripts, fraud and carding guides, data breach exploitation strategies, physical attack planning, and even instructions for chemical and explosive synthesis.

A benchmark comparison table featured in MessiahGPT’s advertisements directly pits the service against mainstream models like ChatGPT-4o, DeepSeek-V3, and Mistral-Large. MessiahGPT positions itself as the only model capable of delivering usable output across categories that other AI platforms typically refuse due to ethical guidelines. This aggressive marketing directly targets individuals frustrated by the limitations of conventional AI, signaling a clear understanding of its intended criminal clientele.

The Rise of Uncensored AI-as-a-Service

MessiahGPT is not an isolated phenomenon. Researchers at Trellix also tracked DarkGPT, another persistently advertised uncensored AI service prevalent across multiple Russian-language Telegram channels. DarkGPT offers three free queries before requiring payment for continued access.

DarkGPT’s marketing openly promises unrestricted malicious code and exploit generation, custom hacker scripts, real-time “instant hacks” for complex scenarios, 24/7 assistance, access to a hacker community, and explicitly branded “BlackHat AI uncensored power for darknet projects.” While it’s unclear if DarkGPT is a truly fine-tuned local model or a sophisticated wrapper around a public LLM, its continuous promotion across channels indicates sustained demand and profitable operations.

The emergence and continued operation of both DarkGPT and MessiahGPT signify that uncensored AI has evolved from a niche novelty into a recognized product category within the cybercriminal ecosystem. Researchers suggest this trend is part of a broader shift towards the commercialization of criminal AI by 2026, with informal Telegram bots maturing into dedicated platforms featuring websites, demo channels, support communities, and tiered pricing structures.

What You Should Do

• Enhance Behavioral Detection: Rely less on signature-based detection and template-matching phishing filters, which are quickly degraded by machine-generated variations. Prioritize behavioral analysis and anomaly detection to identify novel threats.
• Strengthen Identity Controls: Implement robust multi-factor authentication (MFA) across all systems and enforce strict access controls to mitigate the impact of compromised credentials.
• Conduct Continuous User Awareness Training: Educate employees regularly on evolving phishing tactics, social engineering techniques, and the risks associated with AI-generated content. Emphasize vigilance against sophisticated, personalized lures.
• Implement Zero Trust Principles: Assume breach and verify every access request, regardless of origin, to limit lateral movement and contain potential compromises.
• Monitor for Dark Web Activity: Stay informed about new tools and services emerging in cybercriminal forums to anticipate future attack vectors.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.