DIG AI New Darknet AI Platform
Resecurity has identified a dangerous new development in the underground cybercrime market, the rise of DIG AI.
This uncensored artificial intelligence platform is rapidly gaining traction among threat actors, enabling them to automate malicious campaigns and bypass standard digital safety protocols.
First detected on September 29, DIG AI is a “dark LLM” (Large Language Model) hosted on the Tor network.
Unlike legitimate tools like ChatGPT or Claude, which have strict safety filters, DIG AI creates a lawless environment for its users.
According to Resecurity’s HUNTER team, usage of the tool spiked significantly during Q4 2025, particularly around the Winter Holidays, as criminals ramped up operations.
The creator of the tool, operating under the alias “Pitch,” claims the service is based on ChatGPT Turbo but stripped of all ethical guardrails.
Because it requires no account and is accessible via Tor, it offers anonymity to criminals.
DIG AI lowers the barrier to entry for cybercrime. Resecurity analysts found that the tool can generate:
While the tool has limitations computationally heavy tasks like code obfuscation can take 3 to 5 minutes the output is reportedly sufficient to cause significant financial and technological damage.
DIG AI is part of a surging trend of “Not Good AI.” Mentions of malicious AI tools on criminal forums have increased by over 200% between 2024 and 2025.
Tools like FraudGPT and WormGPT paved the way, but DIG AI represents a new frontier where bad actors maintain custom infrastructure to scale their attacks.
With major global events approaching in 2026, including the Winter Olympics in Milan and the FIFA World Cup, experts warn that these tools will likely be used to launch large-scale fraud and disinformation campaigns.
As legislators race to pass acts like the TAKE IT DOWN Act, the rapid evolution of darknet AI continues to outpace regulation.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…