Skip to the main content.
Partner Programs
Already a Partner?
The Value of Partnership with Netenrich



2 min read

FraudGPT: The Villain Avatar of ChatGPT

With the rise of generative AI models, the threat landscape has changed drastically. Now, recent activities on the Dark Web Forum show evidence of the emergence of FraudGPT, which has been circulating on Telegram Channels since July 22, 2023.  

The Netenrich threat research team discovered a new potential AI tool called "FraudGPT." This is an AI bot, exclusively targeted for offensive purposes, such as crafting spear phishing emails, creating cracking tools, carding, etc. The tool is currently being sold on various Dark Web marketplaces and the Telegram platform. 

FraudBot advertised on Dark Web forum


Subscription rates


As evidenced by the promoted content, a threat actor can draft an email that, with a high-level of confidence, will entice recipients to click on the supplied malicious link. This craftiness would play a vital role in business email compromise (BEC) phishing campaigns on organizations.

Spam text example


This also helps attackers write enticing and malicious emails to their targets.

Top sites suggestion


As seen in the above image, it is clear this tool also helps pick up the most targeted services/sites, which can further defraud victims.

Working code example


The subscription fee for FraudGPT starts at $200 per month and goes up to $1,700 per year 

Some of the features include: 

  • Write malicious code
  • Create undetectable malware
  • Find non-VBV bins
  • Create phishing pages
  • Create hacking tools
  • Find groups, sites, markets
  • Write scam pages/letters
  • Find leaks, vulnerabilities
  • Learn to code/hack
  • Find cardable sites 
  • Escrow available 24/7
  • 3,000+ confirmed sales/reviews


Threat Actor Profiling

Before launching FraudGPT, the same threat actor created his Telegram Channel on June 23, 2023.

Note from threat actor to announce his re-establishment on Dark Web marketplaces


The threat actor claimed to be a verified vendor on various Underground Dark Web marketplaces, such as EMPIRE, WHM, TORREZ, WORLD, ALPHABAY, and VERSUS. 

As all these marketplaces are exit scammed frequently, it can be assumed that the threat actor had decided to start a Telegram Channel to offer his services seamlessly, without the issues of Dark Web marketplace exit scams.  

The threat actor had advertised hacking activities, such as:

Offered services ad


Offered services advertisement


Offered services advertisement


Hacking activities carding


Hacking activities advertisement


By tracing the threat actor’s identity as it is registered on a Dark Web forum, we find the threat actor’s email address is: 

Similar project: WormGPT 

Similar to FraudGPT, WormGPT launched on July 13, 2023. These kinds of malicious alternatives to ChatGPT continues to attract criminals and less tech-savvy ne’er-do-wells to target victims for financial gain.

Criminals will not stop innovating — so neither can we 

As time goes on, criminals will find further ways to enhance their criminal capabilities using the tools we invent. While organizations can create ChatGPT (and other tools) with ethical safeguards, it isn’t a difficult feat to reimplement the same technology without those safeguards.

In this case, we are still talking about phishing, which is the initial attempt to get into an environment. Conventional tools can still detect AI-enabled phishing and more importantly, we can also detect subsequent actions by the threat actor.  

Implementing a defense-in-depth strategy with all the security telemetry available for fast analytics has become all the more essential to finding these fast-moving threats before a phishing email can turn into ransomware or data exfiltration. 

For daily threat intelligence updates, visit Netenrich Knowledge Now to learn about the latest global threats impacting organizations. 

How to Achieve Autonomic Security Operations with Resolution Intelligence Cloud?

How to Achieve Autonomic Security Operations with Resolution Intelligence Cloud?

So, what’s a SOC? Some still believe they needa physical SOC building, where they can see, touch, and manage servers. Others feel it’s necessaryto...

Read More
Redefining Cybersecurity ROI: From Tool Accumulation to True Resilience

Redefining Cybersecurity ROI: From Tool Accumulation to True Resilience

In the ever-evolving landscape of cyber threats, it's not surprising that organizations are expanding their cybersecurity budgets to fortify their...

Read More
Discovering the ADHUBLLKA Ransomware Family: Tracing the Roots of LOLKEK, BIT, OBZ, U2K, TZW Variants

Discovering the ADHUBLLKA Ransomware Family: Tracing the Roots of LOLKEK, BIT, OBZ, U2K, TZW Variants

This article is not an in-depth reverse-engineering analysis of a ransomware variant. Rather, it discusses the methods and different techniques used...

Read More