Case unit42-wormgpt4-kawaiigptAI-assisted malwareNov 25, 2025Worldwide

Unit 42 tests WormGPT 4 and KawaiiGPT, criminal LLMs that write ransomware scripts

Unit 42 found WormGPT 4 sold for 50 USD a month with 500+ Telegram subscribers and free KawaiiGPT on GitHub; both produced ransomware PowerShell, ransom notes, spear-phishing and lateral movement scripts in testing.

MediumAttack using AIStatus: OngoingVerified case file

Open in the interactive map Cite this case

Reported: Nov 25, 2025
Location: Worldwide
Target: Phishing, BEC and ransomware victims of subscribers
Severity: Medium
Triggered by: WormGPT 4 and KawaiiGPT developers
Actor type: Criminal
Reported loss: None reported
CVE: None

What happened

Impact: Hundreds of active users; WormGPT 4 generated an AES-256 file encryptor with Tor exfiltration and a 72-hour ransom note in tests.

Who triggered it

Actor: WormGPT 4 and KawaiiGPT developers

Attribution: Unit 42 analysis of underground sales channels and the tools themselves; developers unidentified.

Motive: Subscription revenue and community growth around uncensored AI

How it happened

Attack vector: Web and Telegram sales, DarknetArmy forum ads, GitHub distribution with a CLI

Root cause: Uncensored models and jailbroken wrappers give low-skill actors polished attack content

Timeline

Jul 1, 2025KawaiiGPT first identified
Sep 27, 2025WormGPT 4 sales campaign begins
Nov 25, 2025Unit 42 publishes findings

Response

Unit 42 published analysis and defensive guidance.

Current status: Ongoing

Sources (open in a new tab)

Unit 42 unit42.paloaltonetworks.com
BleepingComputer bleepingcomputer.com

Cite this case

Unit 42 tests WormGPT 4 and KawaiiGPT, criminal LLMs that write ransomware scripts. AI Threat Watch, case unit42-wormgpt4-kawaiigpt, Nov 25, 2025. https://aithreat.io/cases/unit42-wormgpt4-kawaiigpt/

Permanent link: https://aithreat.io/cases/unit42-wormgpt4-kawaiigpt/