New "Uncensored" AI Service *Luciferus* Emerges as Malware-as-a-Service Threat On August 24, 2026, researchers from Sophos’ Counter Threat Unit (CTU) uncovered a new AI-driven cybercriminal service, Luciferus, advertised on the Exploit underground forum. Marketed as an "uncensored" alternative to mainstream AI platforms, the subscription-based tool is designed to generate malicious code, attack guidance, and other cybercriminal resources without ethical or operational restrictions. The service was promoted by a forum user under the alias Optimus_Prime, whose account created on April 18, 2026 had posted 21 times by September 4. The advertisement claims Luciferus operates on a proprietary 120-billion-parameter model, though Sophos could not independently verify its architecture, performance, or privacy safeguards. Researchers suspect it may rely on Alibaba’s Qwen large language models, a common tactic among illicit AI services that rebrand fine-tuned open-source models as proprietary. Luciferus offers multiple subscription tiers, with forum pricing ranging from $35 to $75 per month, including a VIP "Individual Embodiment" package promising a dedicated, customer-trained model. However, the public-facing website displays different pricing ($22–$47.14) and omits the VIP option, leaving discrepancies in advertised features. During testing, Sophos researchers requested a "simple RAT in Python" from the Junior tier, which returned a Russian-language description and source code for a basic remote access trojan. While the code’s functionality was not validated, the test confirmed the model’s willingness to assist in malware development. Unlike jailbroken versions of mainstream AI tools which vendors can patch Luciferus and similar services (e.g., WormGPT, FraudGPT) provide cybercriminals with persistent, unrestricted access to AI-driven attack tools. The emergence of Luciferus underscores the growing commercialization of criminal AI ecosystems, where tiered subscriptions and dedicated support mirror legitimate SaaS models.