MessiahGPT: A New AI-Powered Threat Emerges in Cybercrime Underground A newly uncovered criminal AI service, MessiahGPT, is being openly marketed on BreachForums as a purpose-built offensive tool capable of generating ransomware, phishing kits, stealers, crypters, and rootkits on demand. According to research from the Trellix Advanced Research Center, the service operates via a live platform at messiahgpt[.]de and an active Telegram community, targeting threat actors with no ethical or legal constraints. Unlike typical jailbroken AI models, MessiahGPT’s operator claims it was trained from scratch with no safeguards no reinforcement learning from human feedback (RLHF), no constitutional AI layers, and no internal filters for harm or illegality. The training data reportedly includes unrestricted manuals, dark web archives, leaked documentation, and unfiltered internet scrapes, positioning it as a fully uncensored tool for malicious use. The service employs a Mixture-of-Experts (MoE) architecture with 128 experts, though these technical claims remain unverified. What is confirmed is its low-friction commercial model: users get 50 free queries without registration, followed by paid plans starting at $8 per month (payable in cryptocurrency with no KYC). This pricing makes advanced malware generation accessible to low-skilled actors, eliminating the need for coding expertise or connections to malware-as-a-service vendors. MessiahGPT’s advertised capabilities extend beyond malware, including social engineering scripts, fraud guides, data breach exploitation, physical attack planning, and even chemical/explosive synthesis. A benchmark table in its marketing materials compares it favorably to ChatGPT-4o, DeepSeek-V3, and Mistral-Large, positioning it as the only model that reliably produces usable malicious output without refusals. The service is not alone in this space. Trellix also identified DarkGPT, a persistently advertised uncensored AI tool circulating in Russian-language Telegram channels. DarkGPT offers three free queries before paid tiers, promising unrestricted malicious code generation, custom hacker scripts, real-time exploit assistance, and 24/7 support marketed explicitly as "BlackHat AI" for darknet projects. While its true technical foundation remains unclear, its sustained promotion suggests strong demand in the cybercriminal ecosystem. These developments reflect a broader 2026 shift toward commercialized criminal AI, where uncensored AI-as-a-service has evolved from informal Telegram bots into dedicated platforms with versioned websites, demo channels, and tiered pricing. Security researchers warn that AI-generated phishing lures, ransomware variants, and social engineering attacks will likely surge in volume and sophistication, challenging traditional signature-based detection and template-matching defenses. The rise of these tools underscores the growing accessibility of advanced cyber threats, lowering the barrier to entry for malicious actors.

Trellix Confirms Source Code Repository Breach, Investigates Unauthorized Access Cybersecurity firm Trellix disclosed a security breach involving unauthorized access to a portion of its source code repositories. The company detected the compromise "recently" and has since engaged leading forensic experts to investigate the incident, while also notifying law enforcement. Trellix stated that its investigation has found no evidence that the accessed source code was exploited or that its release and distribution processes were impacted. However, the company did not specify the exact data accessed, the duration of the breach, or the threat actors responsible. Additional details will be shared as the investigation progresses. Formed in January 2022 through the merger of McAfee Enterprise and FireEye, Trellix is owned by Symphony Technology Group. The breach follows Google’s $5.4 billion acquisition of Mandiant, which was previously part of FireEye, around the same time. The incident remains under active investigation.

Iranian Cyberattacks Surge 133% Amid Geopolitical Tensions, Targeting U.S. Critical Infrastructure Nozomi Networks Labs reported a sharp escalation in cyberattacks linked to Iranian threat groups, with a 133% increase in incidents during May and June 2024 compared to the previous two months. The surge peaking at 18 attacks in May before declining to 10 in June coincided with heightened regional conflicts involving Iran, with U.S. organizations as the primary targets. At least 28 confirmed attacks were attributed to six Iranian state-sponsored or affiliated groups: MuddyWater, APT33, OilRig, CyberAv3ngers, FoxKitten, and Homeland Justice. The transportation and manufacturing sectors bore the brunt of the activity, though critical infrastructure, energy, and government entities were also heavily targeted. ### Key Threat Actors & Their Campaigns - MuddyWater emerged as the most active, compromising at least five U.S. companies in transportation and manufacturing. The group, operational since 2017, has historically focused on the Middle East but expanded its reach to North America, Europe, Asia, and the Middle East, targeting government, telecommunications, and energy sectors. - APT33 conducted attacks against three U.S. firms, with infrastructure traced to operations spanning North America, Europe, the Middle East, and Asia, including Germany, France, Saudi Arabia, and Japan. The group’s focus on strategic geopolitical and economic hubs suggests intelligence-gathering and disruption objectives. - OilRig maintained its long-standing campaign against Gulf region targets, including energy, government, and telecommunications sectors, but also extended operations to the U.S., Spain, and Turkey. Attack paths originating from Iran indicate a broader geopolitical and intelligence-driven agenda. - CyberAv3ngers, known for targeting operational technology (OT), reused an IP address from a prior attack and deployed the OrpaCrab (IOCONTROL) malware, first identified in December 2023. The group’s recent activity targeted the U.S., Ukraine, Iraq, and Cyprus, with a focus on critical infrastructure and industrial sectors. - FoxKitten concentrated on Israel, Greece, and North Macedonia, aligning with its history of espionage and long-term access within government and critical infrastructure networks in the Eastern Mediterranean and Middle East. - Homeland Justice, a hacktivist collective, demonstrated a global reach, striking targets in the U.S., Canada, Saudi Arabia, India, and Australia. The group’s politically motivated attacks spanned critical infrastructure and government entities, reflecting a broad disruption strategy. ### Geopolitical Context & U.S. Response The surge in Iranian cyberactivity follows escalating regional tensions, prompting U.S. security agencies to issue warnings last week. Critical infrastructure operators were advised to monitor for threats and isolate OT/ICS assets from public internet access, particularly those with ties to Israeli defense or research entities. The agencies emphasized the heightened risk to the defense industrial base (DIB) and other high-value sectors in the near term. Nozomi Networks confirmed that its threat intelligence feeds including a Mandiant TI Expansion Pack already contain signatures to detect these groups, though the broader threat landscape underscores the expanding scope and sophistication of Iranian cyber operations.