AI Used in Bank Hacking Has Been on Sale in Criminal Markets for Years
With evidence that artificial intelligence (AI) tools were used in the recent cyberattacks targeting South Korean banks, AI products tailored to cybercrime have been confirmed to have been sold in criminal markets for years. The cybercrime world already has a specialized market built on a division of labor, in which developers, data sellers, access brokers, and actual attack operators collaborate as needed. According to Director Baek Se-hyun's analysis, AI has become established within this structure as a tool that accelerates both preparation and execution.
The commodification of criminal AI is a long-standing trend. Kingdom Market, a dark web marketplace that operated from March 2021 until its December 2023 takedown through international cooperation among German federal investigators, the United States, and Switzerland, carried an advertisement selling a six-month access pass for DarkBARD, an AI bot for fraud, at $400. Complete with cryptocurrency payment options for Bitcoin, Litecoin, and Monero, along with a shopping cart and purchase button, the interface was indistinguishable from an ordinary online shopping mall.
In the summer of 2023, WormGPT and FraudGPT for cybercriminal use were reported. The early WormGPT was based on GPT-J and shut down in August of that year, though separate services later emerged under the same name. Netenrich's July 2023 investigation into FraudGPT advertisements listed prices of $200 per month and $1,700 per year. Prices have fallen further. Among WormGPT variants analyzed by Cato Networks in 2025, some services were assessed to be built on Grok and Mistral, a family of open-weight models from France's Mistral AI, and MessiahGPT, revealed by Trellix in August 2026, boasted subscription plans starting at $8 per month with cryptocurrency payment options.
Market growth is also borne out by the numbers. According to a Halcyon investigation covered by Axios on October 6, 2026, roughly 4,000 posts were analyzed from 77 Telegram channels, 20 dark web forums, and five specialized underground marketplaces between October 1, 2025 and May 1, 2026. Observed AI tool advertisements surged from fewer than 50 per month in late 2025 to more than 1,400 in February 2026. In one instance, access to stolen ChatGPT Plus accounts was listed at 10 cents, and individual jailbreak prompts at 32 cents.
These figures, however, do not mean that advertising volume equals actual buyer numbers or successful attack counts. Within the scope of the investigation, no evidence was found of sales of fully autonomous cyberattack systems.
