Malicious LLMs empower inexperienced hackers with advanced tools
Recorded: Nov. 28, 2025, 5:03 p.m.
| Original | Summarized |
Malicious LLMs empower inexperienced hackers with advanced tools News Featured GreyNoise launches free scanner to check if you're part of a botnet The Black Friday 2025 Cybersecurity, IT, VPN, & Antivirus Deals Microsoft to secure Entra ID sign-ins from script injection attacks New ShadowV2 botnet malware used AWS outage as a test opportunity French Football Federation discloses data breach after cyberattack 1TB of Koofr lifetime cloud storage is at an all-time low on Black Friday Prepare for CISSP certification with this training bundle for $20 Malicious LLMs empower inexperienced hackers with advanced tools Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Virus Removal Guides Latest Remove the Theonlinesearch.com Search Redirect Remove the Smartwebfinder.com Search Redirect How to remove the PBlock+ adware browser extension Remove the Toksearches.xyz Search Redirect Remove Security Tool and SecurityTool (Uninstall Guide) How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Antivirus 2009 (Uninstall Instructions) Locky Ransomware Information, Help Guide, and FAQ CryptoLocker Ransomware Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ Downloads Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Startup Database HomeNewsSecurityMalicious LLMs empower inexperienced hackers with advanced tools
Malicious LLMs empower inexperienced hackers with advanced tools By Bill Toulas November 27, 2025 Unrestricted large language models (LLMs) like WormGPT 4 and KawaiiGPT are improving their capabilities to generate malicious code, delivering functional scripts for ransomware encryptors and lateral movement. A free, community-driven alternative is KawaiiGPT, spotted this year in July, which can generate well-crafted phishing messages and automate lateral movement by producing ready-to-run scripts. The generated data encryption scriptSource: Unit 42 The generated ransom noteSource: Unit 42 Phishing email generated on KawaiiGPTSource: Unit 42 Data exfiltration functionSource: Unit 42 7 Security Best Practices for MCP Related Articles: AI Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Microsoft: Exchange Online outage blocks access to Outlook mailboxes Code beautifiers expose credentials from banks, govt, tech orgs Microsoft is speeding up the Teams desktop client for Windows Sponsor Posts Overdue a password health-check? Audit your Active Directory for free Review of Passwork: Affordable Enterprise-Grade Password Manager CMMC Made Simple. Get audit-ready with Huntress—faster, easier, and more affordable. WSUS can’t keep up in a remote-first world. Cloud-native patching fixes what VPNs never could Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Malicious large language models (LLMs) are significantly lowering the barrier to entry for cybercrime, empowering inexperienced hackers with sophisticated tools and capabilities. Unit 42 researchers have identified two recently emerged LLMs, WormGPT 4 and KawaiiGPT, actively being utilized by cybercriminals. These models, accessible through paid subscriptions or free local instances, are demonstrating a tangible shift in the threat landscape, moving beyond theoretical risks to a present, operational reality. WormGPT 4, a resurgence of the 2023 model, is capable of generating functional ransomware code, specifically demonstrated by its ability to encrypt all PDF files on a Windows host using AES-256 encryption and, crucially, exfiltrate data via the Tor network. Furthermore, the model can produce sophisticated “ransom notes” complete with military-grade encryption claims and a 72-hour deadline, highlighting the potential for convincing and alarming attacks. The research indicated that WormGPT 4 provides credible linguistic manipulation for both Business Email Compromise (BEC) and phishing attacks, enabling low-skilled attackers to conduct more complex operations typically executed by experienced threat actors. The model’s support channels are populated by hundreds of subscribed members who exchange tips and advice, showcasing the model’s growing influence within the cybercrime community. KawaiiGPT, a newer model documented this year, presents a different, yet equally concerning, set of capabilities. While it doesn’t directly generate encryption routines, Unit 42 researchers found that setting up KawaiiGPT on a Linux system takes only five minutes. The model can generate realistic spear-phishing messages complete with domain spoofing and credential harvesting links. More alarmingly, it can produce Python scripts for lateral movement using the paramiko SSH library to remotely execute commands, or generate scripts for recursively searching a Windows filesystem using `os.walk` and exfiltrating the data via smtplib. It can also generate customized ransom notes with adjustable payment instructions, timelines, and encryption strength claims. The model’s relative ease of use dramatically reduces the time and expertise required for attackers to develop and deploy malicious tools. The core concern raised by Unit 42 is that these LLMs are accelerating the pace of cybercrime. Traditional hacking requires significant research, tool development, and expertise. These models streamline that process, allowing even inexperienced attackers to conduct sophisticated operations. The generated “polish” in the phishing lures diminishes the telltale grammatical errors often found in traditional scams, making them more convincing. Importantly, both models have dedicated Telegram channels with hundreds of subscribers sharing tips and advice, demonstrating a burgeoning community supporting and developing the use of these tools. As Model Context Protocol (MCP) becomes the standard for connecting LLMs to tools and data, security teams are actively adapting to these new services. Unit 42 has highlighted the need for 7 key security best practices to mitigate the risks associated with these powerful, accessible tools. These practices represent an urgent response to the evolving threat landscape. |