MessiahGPT: Uncensored Criminal AI Model Marketed on BreachForums for Malware, Phishing, and Fraud Generation — Threadlinqs Intelligence
As of 2026-08-16, MessiahGPT: Uncensored Criminal AI Model Marketed on BreachForums for Malware, Phishing, and Fraud Generation is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 6 indicators of compromise.
Threat ID: TL-2026-2036 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Trellix Advanced Research Center identified MessiahGPT, a criminal AI-as-a-service model advertised on BreachForums since July 2026 and offered live at messiahgpt[.]de plus a Telegram community,
MessiahGPT is a criminal AI service openly marketed on BreachForums, first advertised in an English-language dark-web listing in July 2026 and subsequently documented by the Trellix Advanced Research Center, whose findings were reported by Cyber Security News on 2026-08-14. The operator claims the underlying model was 'trained from scratch' rather than jailbroken from an existing commercial model, asserting no Reinforcement Learning from Human Feedback (RLHF), no Constitutional AI safety layer, and no internal concept of harm or illegality. The operator further claims a Mixture-of-Experts architecture (128 total experts, 16 active per token) trained on 'unrestricted manuals, dark web archives, leaked documentation, and raw internet scrapes with no post-filtering.' Trellix explicitly notes these architecture and training claims cannot be independently verified.
The service advertises on-demand generation of ransomware, phishing kits, stealers, crypters, and rootkits, as well as social engineering scripts, fraud and carding guides, data breach exploitation content, and — beyond the cyber domain — physical and chemical/explosive attack planning material. Separately, Accenture and Google Threat Intelligence Group researchers (Ryan Whelan; John Hultquist), presenting related AI-abuse findings at Black Hat USA 2026 and covered by Cybersecurity Dive on 2026-08-12, cited MessiahGPT as a tool observed generating exploits, payloads, proof-of-concept code, and refactored/rewritten malware for buyers who previously needed genuine development skill or a malware-as-a-service relationship.
Access is frictionless and low-cost: a free tier offers 50 queries with no registration, and paid tiers start around $8/month, payable only in cryptocurrency with no KYC verification. The listing includes a benchmark comparison table pitting MessiahGPT against ChatGPT-4o, DeepSeek-V3, and Mistral-Large, marketing itself as the only model that returns usable output across every category the mainstream models refuse.
Trellix separately tracks a related/competing service, DarkGPT, circulating on Russian-language Telegram channels and marketed as 'BlackHat AI uncensored power for darknet projects,' offering three free queries before paid tiers. Trellix frames both as part of a broader 2026 shift in which uncensored AI-as-a-service has matured from informal Telegram bots into dedicated platforms with versioned websites, demo channels, and tiered subscription pricing — a standing criminal product category rather than a novelty.
Direct verification on 2026-08-16 found messiahgpt[.]de still live and reachable, now fronted with the headline 'MessiahGPT — AI for Coding, Pentesting & OSINT | 25 Free Msgs/hr' — a dual-use, legitimizing rebrand of the same underlying service, consistent with the operator's strategy of framing overtly offensive capability as generic security-research tooling to reduce takedown/abuse-report friction. No confirmed intrusion, breach, or malware sample has yet been publicly attributed to MessiahGPT-generated output in the sources reviewed; the threat as documented is the existence and low-barrier availability of the generation service itself.
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 6 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1593, T1587, T1587.001, T1587.004, T1588.007, T1583.001, T1566, T1204, T1027, T1027.002
