“As AI tooling and capabilities evolve, organizations should continue to prioritize strong cyber hygiene such as timely patching, multifactor authentication (MFA), and passkey use to reduce exposure to established tradecraft and future AI-assisted acceleration,” Sophos CTU said.
Sophos CTU analysis of underground chatter
Sophos Counter Threat Unit (CTU) reported that analysis of discussion boards, dark web marketplaces and messaging apps shows cybercriminal communities are debating the arrival of AI tools the same way many legitimate workforces have: with a mixture of optimism, skepticism and anxiety. The firm says vendors on underground markets increasingly advertise "AI-powered kits" to assist in phishing, social engineering, malware development and activity inside compromised networks, while forum users trade views on how these tools will reshape roles, pricing and competitive advantage.
AI toolkits now for sale — and what sellers claim they do
Sophos documented concrete vendor claims and user examples. Sellers, both established and newly appearing, advertise toolkits that they say use generative AI to overcome language barriers, distribute content at scale and quickly respond to victims who engage with a lure. Other postings describe AI-generated deepfake audio and video used to build realistic profiles for romance fraud, and some listings claim to automate malware coding with AI. Those are seller claims and user reports captured by Sophos in its blog post.
Claude Mythos Preview sparked a spike in discussion
The research notes a clear uptick in forum conversation after the launch of Claude Mythos Preview, a frontier AI tool from Anthropic that its developers say can rapidly identify security vulnerabilities. Forum reactions were mixed: some users expressed cynicism, calling corporate concern an "overreaction," while others voiced real worry that AI could erode manual malware developers’ livelihoods or reduce product quality if authors outsource coding to models. One user warned that the rise of AI-powered offerings could “take money away from manual malware developers” and that 'products' might worsen when creators rely on AI.
Advocates, opponents — and silent experimenters
Sophos observed that the loudest voices on underground forums drive much of the visible debate, but they also cautioned the picture is incomplete because many threat actors may not publicly participate. While advocates tout speed, language assistance and automation, opponents question accuracy and impact on their tradecraft. Meanwhile, Sophos highlighted a cohort of operators who may be quietly testing AI’s practical limits rather than posting about their experiments.
What this means for technologists, enterprises, and threat actors
- Technologists and security teams: Sophos CTU's explicit guidance is to prioritize timely patching, multifactor authentication (MFA) and passkey adoption, and to maintain environment-wide visibility to spot anomalous activity before attacks escalate.
- Enterprises and procurement leaders: Sophos’ findings suggest organizations should watch how underground markets evolve — both the appearance of AI toolkits and potential shifts in pricing or offensive tradecraft — since those market dynamics can alter the scale and style of attacks they will face.
- Adversaries and threat actors: According to Sophos, the underground is split — some will adopt advertised AI toolkits for phishing, deepfakes and code automation; others fear AI will displace manual developers or degrade product quality; and a portion will quietly probe where AI actually helps or fails.
The central fact is straightforward: AI is now a visible line item in the criminal economy, and it is already changing how some attackers advertise and plan operations. Sophos CTU’s practical prescription — patch, enable MFA and passkeys, and keep visibility — is likewise simple but specific. What remains to be seen, and what Sophos’ review leaves as an open question, is whether this wave of AI-enabled tooling will concentrate capability in the hands of a few sellers, erode the livelihoods of manual operators, or produce a new equilibrium of hybrid human-plus-AI tradecraft.
https://www.infosecurity-magazine.com/news/cybercriminals-worried-ai-take/
