--- title: Criminal AI-as-a-Service in 2026: How the Underground... description: The underground criminal AI market has matured into a 'Criminal AI-as-a-Service' ecosystem by 2026, where threat actors use AI not to replace themselves but to... canonical: https://daily.dev/posts/criminal-ai-as-a-service-in-2026-how-the-underground-market-is-operationalizing-cybercrime-styx8ibsc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Criminal AI-as-a-Service in 2026: How the Underground Market Is Operationalizing Cybercrime | daily.dev og:description: The underground criminal AI market has matured into a 'Criminal AI-as-a-Service' ecosystem by 2026, where threat actors use AI not to replace themselves but to... og:url: https://daily.dev/posts/criminal-ai-as-a-service-in-2026-how-the-underground-market-is-operationalizing-cybercrime-styx8ibsc og:image: https://api.daily.dev/og/posts/STYX8ibsc.png og:image:alt: Criminal AI-as-a-Service in 2026: How the Underground Market Is Operationalizing Cybercrime og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Criminal AI-as-a-Service in 2026: How the Underground Market Is Operationalizing Cybercrime **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 16 min read · 0 upvotes · 0 comments ## Summary The underground criminal AI market has matured into a 'Criminal AI-as-a-Service' ecosystem by 2026, where threat actors use AI not to replace themselves but to accelerate and scale routine criminal tasks. Key tool families include FraudGPT, WormGPT, GhostGPT, BruteForceAI, and Xanthorox, ranging from mass-market phishing assistants to precision attack execution platforms. Stolen AI accounts and hijacked API keys have emerged as a significant criminal commodity, enabling attackers to leverage legitimate AI infrastructure. Deepfake services now support KYC bypass, identity fraud, and impersonation at scale. Defensively, organizations must treat AI accounts and API keys as critical assets, move beyond grammar-based phishing detection, improve data governance, and integrate AI risk into existing security governance frameworks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [KasadaIQ’s Q1 Insights: How AI Became Adversary Infrastructure](https://daily.dev/posts/kasadaiq-s-q1-insights-how-ai-became-adversary-infrastructure-a1zsklmxk) · Security Boulevard · 1 upvotes · 0 comments - [AI tools becoming hot commodities on ransomware marketplaces](https://daily.dev/posts/ai-tools-becoming-hot-commodities-on-ransomware-marketplaces-1fglfuwn6) · CSO Online · 0 upvotes · 0 comments - [AI-driven fraud far more profitable, Interpol warns](https://daily.dev/posts/ai-driven-fraud-far-more-profitable-interpol-warns-tmri6xhox) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/criminal-ai-as-a-service-in-2026-how-the-underground-market-is-operationalizing-cybercrime-styx8ibsc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Criminal AI-as-a-Service in 2026: How the Underground Market Is Operationalizing Cybercrime","url":"https://daily.dev/posts/criminal-ai-as-a-service-in-2026-how-the-underground-market-is-operationalizing-cybercrime-styx8ibsc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/criminal-ai-as-a-service-in-2026-how-the-underground-market-is-operationalizing-cybercrime-styx8ibsc"},"datePublished":"2026-06-11T13:17:38.630Z","dateModified":"2026-06-11T13:18:08.316Z","description":"The underground criminal AI market has matured into a 'Criminal AI-as-a-Service' ecosystem by 2026, where threat actors use AI not to replace themselves but to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/643a33b02500bbf89c201279befb41c9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/643a33b02500bbf89c201279befb41c9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/criminal-ai-as-a-service-in-2026-how-the-underground-market-is-operationalizing-cybercrime-styx8ibsc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,phishing","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"Criminal AI-as-a-Service in 2026: How the Underground Market Is Operationalizing Cybercrime"}]} ```