Warning: Malicious AI Tools Are Spreading in the Criminal Underground

Trellix researchers found multiple commercialized AI-powered offerings on underground forums in early 2026 that automate and commoditize the attack lifecycle—reconnaissance, exploit development, payload delivery, evasion, and post-compromise operations. Tools like “APEX AI” can produce step-by-step ransomware plans and identify spear-phishing targets, signaling a shift from experimental use of AI in crime to structured, service-oriented offerings (pricing tiers, support, updates, reviews) that lower the skill threshold and are likely to increase the speed, scale, and sophistication of cyberattacks.