On 16 February 2026 an Indonesian-language Telegram advertisement sold something it called WormGPT for 10,000 rupiah, paid once, with free updates. The seller was explicit about the product. It was a prompt said to convert services such as DeepSeek, Gemini or Meta AI into “WormGPT”, so the advertised product was text rather than a model. The seller also claimed that comparable packs are usually available elsewhere for USD 5 to 10 (XT-A009).
In this article, “AI-branded tools” are products sold under brand strings such as WormGPT, FraudGPT, DarkGPT, EvilGPT and a few other “uncensored AI” labels. We read 607 distinct texts pooled from seven such brand searches, dated 1 January to 27 October 2026, and 168 were offers of some kind. The WormGPT search alone returned 541 distinct texts, 147 of them offer-type. Unless we say otherwise, the counts below use the seven-brand pool.
Those 168 mostly sell an access point, meaning a website, a Telegram bot or a phone application marketed as having no limits. Most do not say which model runs behind that access point. The counts below show how far this pattern goes, and what a defender can reasonably conclude from it.
What Do the Brand Names Attach To?
Among the 168 offer texts, the brand was attached to four kinds of product. The counts are distinct texts, not sellers or sales.
| Name attached to | Texts | What the advertisement says the buyer gets |
|---|---|---|
| Hosted access or subscription | 141 texts | A login to a site, bot or app, sometimes with a reseller tier, as in XT-A001 and XT-A005. |
| Persona prompt or jailbreak pack | 15 texts | Text to paste into a mainstream assistant, as in XT-A009 and XT-A010. |
| Source code, a file or a build service | 7 texts | Code to run and rebrand your own copy of a bot or site, as in XT-A008 and XT-A016. |
| Name reused for another service | 5 texts | A credential-checker converter, an image service or a rented interview assistant, as in XT-A012 and XT-A017. |
What Is the Hosted Product in These Ads?
The 141 hosted texts give a handle on the product without needing a backend. We hand-checked them for delivery surface, stated features and tier structure. A single AI reader did this coding without a second-reader check, so the counts are descriptive rather than precise measurements.
Delivery is mostly a front door to something unseen. Forty-nine texts name a website or web app, 29 a Telegram bot and 23 a phone app or APK. Eight sell a shared or resold account, and six sell API-key access. Forty-four name no surface at all, and 17 name more than one.
The feature claims are surprisingly thin. Sixty-five texts state no feature whatsoever. Fifty-six advertise “no limits” or uncensored answers, 34 claim code, malware or hacking help, 21 image, video or voice, and only 8 phishing or scam text. These are advertised claims, and capability was never tested or verified.
Tier structure shows how the product is meant to be distributed. Fifty-nine texts state a price, 23 offer several tiers or durations, 23 sell a reseller tier and 14 offer a trial. Six of the reseller texts are receipt reposts and five are short “reseller APK” ads, so repetition across channels inflates that count considerably.
Which Model Runs Underneath?
For most of the 141, the text does not say. Counting only a named model or API, 122 texts state no backend. Three name other models, 8 give only a version label, 3 list several models without naming them, and 5 present the product as resold accounts or an upstream subscription. Our two readers agreed poorly on this particular field (Cohen’s kappa 0.24), so treat these counts as indicative and calculate no percentage from them.
Where a backend does appear in the offer texts, it usually belongs to somebody else entirely. By first-coder counts across the offer texts, about 13 name a jailbreak target, 7 resell mainstream API keys or accounts and 6 list a multi-model bundle. These counts are indicative only, given the weak agreement on this field.
A forum advertisement of 28 March lists a jailbroken Claude as a Pro product (XT-A014). Another, dated 27 August, describes several third-party models behind one system prompt, sold by the hour or by the month (XT-A025).
Outside researchers describe the same blind spot. Unit 42 wrote in November 2025 that the developers of WormGPT 4 “neither confirm nor deny” whether they rely on a fine-tuned model or on persistent jailbreaking. It also reports that the 2023 original shut down in mid-2023 amid negative publicity, so the name outlived its first product.
In a June 2025 report, Cisco Talos described trying to buy FraudGPT access and concluded that the seller had no working product. Neither case shows what a 2026 reseller’s bot runs.
Who Sells It, and What Do They Ask?
Seventy-eight of the 168 offer texts in the seven-brand pool state a price. Of those, 57 use rupiah or only a “k” suffix, 18 use a bare dollar sign and 3 use other marks. Forty-seven of the 57 carry an Indonesian tag. Rupiah and dollar asks are therefore sub-markets by language tag (tags describe texts, not sellers), and we apply no currency conversion.
The only in-ad comparison is the seller’s own claim in XT-A009: 10,000 IDR here against USD 5 to 10 elsewhere. A 19 January menu prices access at Rp3.000, a reseller tier at Rp5.000 and a jailbreak package at Rp10.000. The same seller lists panel, VPN and VPS items (XT-A003). English-language asks reach $20 or $30 a month and $170 for lifetime access, all written with an unspecified dollar sign.
The reseller tier is the clearest commercial characteristic of these advertisements. One 11 January advertisement recruits channel owners and promises half of each sale, with the calculation base left undefined (XT-A002). A June advertisement prices a reseller licence above the user licence (XT-A018). Of the 168, 67 carry an Indonesian tag and 27 carry none, so 67 is a lower bound.
Names Float, Collide and Get Breached
Not every matching text is an advertisement for anything. Requests and questions make up approximately 22% of the 607 texts, and 117 are irrelevant noise, including 43 game-cheat scripts credited to the persona. For the WormGPT search alone, about 60% of distinct texts concern an AI product at all.
Names also collide with unrelated products. A “DarkGPT” bot turns credential-checker configurations into runnable checkers, and an “EvilGPT” sub-site brands an undress-image service (XT-A017). A “GhostGPT” rents out an interview-assistant account (XT-A026). Seven distinct shop-bot texts list WormGPT, FraudGPT or EvilGPT beside ordinary AI accounts, as in XT-A019.
One collision is a reported event: four distinct texts, dated 10 February to 2 October, offer or discuss a database said to come from a WormGPT-branded service. Two Russian-language news relays of 11 February disagree with each other: one speaks of about 19 thousand subscribers, the other of 4,169 unique users. Forum posts said more than 19,000 lines or users, and we did not open the data. The alleged breach remains unverified.
How Far Does This Slice Reach?
This slice probably over-represents one visible retail ecosystem. Telegram supplies most of the offer texts, and reposted menus can look like a much larger market than they are. Private sellers operating a proprietary model would sit outside what these searches can realistically reach. We cannot rule such sellers out, and we can only describe the visible trade.
What Does This Mean for AI Accounts, Keys and Devices?
The evidence supports three narrow points, and we mark which come from outside sources. Because the backend of most hosted offers is unknown, none of the three says that accounts or keys are the whole story.
- Treat AI accounts and keys as credentials: resold accounts (8 texts) and API-key access (6) appear among the hosted offers, and another 15 texts sell prompts aimed at mainstream assistants. Our reading: register each paid AI account and key with an owner, a rotation date and unusual-use monitoring. Microsoft reported in 2025 that the Storm-2139 network exploited exposed customer credentials scraped from public sources to reach generative AI services, then resold access.
- Do not rely on brand-name blocklists: the same names label a checker tool, an image service and an interview assistant (XT-A012, XT-A017, XT-A026). Also, 37 of 605 retained WormGPT-search posts did not contain the name at all. This is our reading of the collision evidence.
- Treat the access points as untrusted software: Many hosted offers are websites, bots and phone apps of unknown provenance, including 23 that name an app or APK. Our reading: on employee devices these are untrusted external services. We make no claim about what they do or what they are capable of.
On phishing text, Talos describes these tools as a force multiplier for familiar attacks, and Unit 42 judged WormGPT 4 output persuasive in its own tests. Test your phishing defences without assuming that the message wording will be clumsy. For how sellers package material for fraud, see our identity-fraud offers study and the fraud chapter. Where the accounts involved are ordinary commercial generative AI products, existing identity and access management already covers them.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
