Cybercriminals are using a new and highly capable uncensored AI tool called DIG AI, which appeared on the Darknet. The “not good” AI is actively misused for fraud, malware creation, terrorism, child sexual abuse material (CSAM), and other criminal activities, security firm Resecurity warns.
DIG AI was identified on the dark web on September 29th, 2025. Its maintainer boasted on the dark web forum that DIG answered 10,000 prompts during the first 24 hours of operation.
Resecurity’s cyber threat intelligence team observed a notable increase in malicious actors’ utilization of DIG AI during Q4 2025, accelerated by the winter holidays.
Contrary to previous AI tools marketed to cybercriminals as subscription services, such as FraudGPT or WormGPT, DIG requires no account and is free to use on the TOR network, despite the maintainer's claim that it operates the service on-premises.
DIG AI also highlights rapidly increasing capabilities of uncensored AI, enabling cyberattackers, terrorists, and other criminals to scale their operations.
Resecurity conducted numerous tests and confirmed that DIG AI complied and responded to prompts related to explosives, drugs, prohibited substances, fraud, and other areas restricted by international legislation. The bot generated malicious scripts to plant backdoors and other types of malware.
This tool can be used by criminals to generate malicious, fraudulent, or scam content and optimize other resource-intensive tasks.
DIG AI’s output was “sufficient for conducting malicious activities in practice.” Some screenshots include AI-generated guidance on explosive device construction, fraud, and malicious scripts, among others.
“This is a new frontier of ‘Not Good AI’ – where bad actors design, operate, and maintain custom infrastructure and even data centers like those used for bulletproof hosting, but for criminal AI to scale operations effectively, considering load, simultaneous requests, and multiple customers leveraging it,” Resecurity said in a report on DIG AI, an uncensored AI assistant service used by criminals and terrorists.
DIG AI was confirmed to be capable of facilitating the production of CSAM content. It can create entirely synthetic content or manipulate benign images of real minors.
The dark web tool still has limitations. The researchers noted that some operations took 3-5 minutes to complete, indicating that the system had limited computing resources. However, these can be easily mitigated by offering a paid service.
“Banners for DIG AI were found on several marketplaces on the TOR network involved in illegal operations, such as drug trafficking and the monetization of compromised payment data, which may highlight the audience of potential end customers,” Resecurity said.
The maintainer, who uses the alias Pitch, claims that one of the three offered DIG AI models is based on ChatGPT Turbo.
Between 2024 and 2025, mentions and use of malicious AI tools on cybercriminal forums have increased threefold, as cybercriminals rapidly adopt AI technologies, and new LLMs appear regularly.
The defenders fear that 2026 wil bring “ominous security challenges enabled by AI.”
“With important events scheduled for 2026, including the Winter Olympics in Milan and the FIFA World Cup, criminal AI will pose new threats and security challenges,” Resecurity researchers warn. “These tools lower the barrier for cybercrime by automating and enhancing malicious activities.”
Unlock more exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked