Case xanthorox-ai-darknetAI-assisted malwareWorldwide
Xanthorox AI: self-hosted five-model criminal platform marketed as WormGPT killer
SlashNext found Xanthorox AI on darknet forums from late Q1 2025, claiming five custom models on private servers for coding, vision, reasoning and voice; seller screenshots showed Defender-evading ransomware output.
MediumAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 7, 2025
- Location
- Worldwide
- Target
- Potential phishing and malware victims worldwide
- Severity
- Medium
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
SlashNext found Xanthorox AI on darknet forums from late Q1 2025, claiming five custom models on private servers for coding, vision, reasoning and voice; seller screenshots showed Defender-evading ransomware output.
Impact: Lowered the bar for phishing, social engineering and malware creation; real-world attack volume attributable to the tool not established.
Who triggered it
Actor: Unknown
Attribution: SlashNext researchers documented seller claims; capabilities largely unverified beyond vendor screenshots.
Motive: Selling malicious AI tooling to cybercriminals
How it happened
Attack vector: Subscription access to a modular malicious AI suite sold through darknet forums and encrypted channels
Root cause: Locally hosted models outside commercial provider controls avoid guardrails and takedowns
Timeline
- Xanthorox AI first spotted circulating in cybercrime communities
- SlashNext publishes analysis of the platform
Response
SlashNext published the analysis and indicators; no takedown reported.
Current status: Ongoing
Sources (open in a new tab)
- SlashNext via Security Boulevard securityboulevard.com
- Infosecurity Magazine infosecurity-magazine.com
- eSecurity Planet esecurityplanet.com
Cite this case
Xanthorox AI: self-hosted five-model criminal platform marketed as WormGPT killer. AI Threat Watch, case xanthorox-ai-darknet, Apr 7, 2025. https://aithreat.io/cases/xanthorox-ai-darknet/
Permanent link: https://aithreat.io/cases/xanthorox-ai-darknet/