New "Uncensored" AI Service *Luciferus* Emerges as Malware-as-a-Service Threat On August 24, 2026, researchers from Sophos’ Counter Threat Unit (CTU) uncovered a new AI-driven cybercriminal service, Luciferus, advertised on the Exploit underground forum. Marketed as an "uncensored" alternative to mainstream AI platforms, the subscription-based tool is designed to generate malicious code, attack guidance, and other cybercriminal resources without ethical or operational restrictions. The service was promoted by a forum user under the alias Optimus_Prime, whose account created on April 18, 2026 had posted 21 times by September 4. The advertisement claims Luciferus operates on a proprietary 120-billion-parameter model, though Sophos could not independently verify its architecture, performance, or privacy safeguards. Researchers suspect it may rely on Alibaba’s Qwen large language models, a common tactic among illicit AI services that rebrand fine-tuned open-source models as proprietary. Luciferus offers multiple subscription tiers, with forum pricing ranging from $35 to $75 per month, including a VIP "Individual Embodiment" package promising a dedicated, customer-trained model. However, the public-facing website displays different pricing ($22–$47.14) and omits the VIP option, leaving discrepancies in advertised features. During testing, Sophos researchers requested a "simple RAT in Python" from the Junior tier, which returned a Russian-language description and source code for a basic remote access trojan. While the code’s functionality was not validated, the test confirmed the model’s willingness to assist in malware development. Unlike jailbroken versions of mainstream AI tools which vendors can patch Luciferus and similar services (e.g., WormGPT, FraudGPT) provide cybercriminals with persistent, unrestricted access to AI-driven attack tools. The emergence of Luciferus underscores the growing commercialization of criminal AI ecosystems, where tiered subscriptions and dedicated support mirror legitimate SaaS models.

AI Credential Theft Fuels Massive Proxy Network Exploiting Frontier Models Researchers from Team Cymru have uncovered a vast network of over 80,000 proxy servers, known as transfer stations, designed to obscure the origin of traffic to leading AI models. These relays primarily hosted on U.S.-based VPS services enable threat actors to conduct model distillation attacks, where stolen API credentials and subscription keys are abused to extract proprietary AI knowledge for unauthorized training or resale. The investigation traced activity to IP addresses in China and Hong Kong, with traffic patterns revealing distinct behaviors: Chinese AI services (DeepSeek, Qwen, Zhipu, MiniMax, ByteDance’s Doubao) saw download-heavy interactions, while Western providers (Anthropic, OpenAI, Google, xAI) experienced upload-heavy traffic consistent with automated querying for model extraction. Over an eight-day period in late August, the relays processed 14TB of outbound data and 7TB inbound, with one cluster alone uploading enough text to represent 16–23 billion input tokens. The ecosystem relies on open-source relay platforms like Claude Relay Service (CRS) and its successor, sub2api developed by a GitHub user known as Wei-Shaw which has been forked 8,000+ times and boasts 7,000 Telegram subscribers. The project’s GitHub page lists 26 commercial sponsors, including API resellers, residential proxy vendors, and AI account providers, suggesting a thriving underground market. Credentials are harvested through information stealers, phishing, and supply-chain attacks, with Okta Threat Intelligence identifying 561 Anthropic session tokens from 5,871 infected machines, alongside 24 valid API keys for Gemini, OpenAI, Groq, and OpenRouter. A Chinese-speaking threat actor was observed validating 2,975 stolen credentials from 1,742 hosts, including keys for Gemini (448), OpenAI (254), and Anthropic (176), before funneling them into AI API-reselling gateways. Security experts warn that these relays bypass frontier-model controls by masking the true origin of requests, enabling fraud and policy violations. Scott Fisher of Team Cymru noted that the system "breaks the assumption that the account making a request belongs to the party consuming the answer," while Joe Brinkley of Cobalt emphasized the need for behavioral telemetry, sybil defenses, and output controls to counter extraction attempts. The findings align with broader trends, including Palo Alto Networks’ discovery of similar relays using platforms like new-api and one-api, advertised on Chinese marketplaces such as Taobao. With enterprise AI credentials increasingly targeted, organizations are urged to treat them as high-value secrets, replacing long-lived keys with short-lived tokens, enforcing spending limits, and monitoring for unusual activity.

Critical RCE Vulnerability in MS-Agent AI Framework Exposes Systems to Full Compromise A severe security flaw (CVE-2026-2256) has been identified in ModelScope’s MS-Agent framework, a lightweight tool enabling AI agents to execute autonomous system commands. The vulnerability, rated 9.8 (CVSS v3.1), allows attackers to perform remote code execution (RCE) by exploiting inadequate input sanitization in the framework’s "Shell tool." The flaw stems from prompt injection attacks, where malicious commands embedded in seemingly benign input such as documents or code are passed unsanitized to the OS. While MS-Agent employs a basic `check_safe()` denylist to block dangerous commands, researchers found it can be bypassed through command obfuscation or alternative syntax, rendering the defense ineffective. Successful exploitation grants attackers arbitrary command execution with the same privileges as the MS-Agent process, enabling: - Data exfiltration of sensitive files accessible to the AI. - Modification or deletion of critical system files. - Persistence mechanisms, including backdoor installation. - Lateral movement across enterprise networks. As of the CERT/CC disclosure, the vendor has not released a patch or official response. Organizations using MS-Agent are urged to mitigate risks by sandboxing the agent, enforcing least-privilege access, validating all ingested content, and replacing denylists with strict allowlists to restrict permitted commands. The incident underscores the escalating security risks of AI agents with unchecked OS access.