As artificial intelligence becomes more accessible, cybercriminals are also finding new ways to use AI to support malicious activity. The concern is no longer limited to attackers using mainstream AI tools. Sophos Counter Threat Unit™ (CTU) researchers are seeing AI increasingly packaged and sold as a service through underground forums and cybercriminal marketplaces.
Sophos CTU recently identified an underground AI subscription service called Luciferus, advertised as an “uncensored” AI system designed to respond to requests without the safeguards normally built into mainstream commercial AI platforms. Sophos researchers did not independently verify many of the service's technical and performance claims, but testing observed by CTU showed the service responding to an explicit request involving malware development.
For businesses, the wider issue is more important than any single AI service. AI is becoming another commercialised tool within the cybercrime ecosystem, potentially making malicious capabilities easier to access attackers who previously needed greater technical expertise.
Uncensored AI Services Are Becoming Part of the Cybercrime Economy
Sophos CTU observed Luciferus being promoted on the Exploit underground forum in August 2026. The service was marketed through monthly subscription tiers, with its operators claiming users could access an AI model without ethical restrictions. Sophos notes that claims about proprietary models in underground markets should be treated carefully, as many services may rely on existing open-source models, fine-tuning, custom prompts, or orchestration rather than entirely new AI systems.
Luciferus reflects a broader shift in cybercrime. Similar to ransomware-as-a-service, phishing kits, and malware subscriptions, AI capabilities are increasingly being packaged into services that users can purchase rather than develop themselves. Sophos has also observed threat actors selling access to legitimate AI platforms, sharing API keys, providing AI prompt-engineering services, and bundling access to multiple AI models.
AI Could Lower the Technical Barrier for Cyberattacks
One of the main concerns surrounding uncensored AI services is their willingness to respond to overtly malicious requests. In Sophos' research, Luciferus produced a response to a prompt requesting a Python remote access trojan. Sophos did not execute or verify the completeness of the generated code, but the result supported the service advertised willingness to assist with malware-related requests.
This does not mean AI automatically turns inexperienced users into advanced attackers. However, commercially available AI services can reduce some of the knowledge and effort required to create malicious scripts, phishing content, social-engineering material, and other attack components. Sophos CTU says increased activity around AI services and AI-specialist recruitment in underground communities suggests AI is becoming a more accessible part of cybercriminal operations.
Businesses Need Security That Can Detect Faster-Moving Threats
The rise of underground AI services reinforces the need for businesses to focus on layered cybersecurity rather than relying on a single security product. As attackers gain easier access to automation and AI-assisted capabilities, organisations need stronger visibility across endpoints, identities, email, networks, cloud environments, and user activity.
Effective cyber resilience also requires continuous monitoring and faster investigation when suspicious behaviour appears. Endpoint protection, extended detection and response, managed detection and response, network security, email protection, identity security, vulnerability management, backup, and incident response all contribute to reducing the opportunity for AI-assisted attacks to become successful business incidents. Sophos provides security technologies and managed services across these areas.
How JK Tech Helps
As an official Sophos partner, JK Tech helps businesses strengthen cyber resilience with Sophos security solutions covering endpoints, networks, email, identities, cloud environments, XDR and MDR, supported by deployment, configuration, monitoring, backup, recovery, and managed IT services. JK Tech can also help organisations assess security gaps, improve threat visibility, strengthen protection across critical systems, and build a more coordinated security environment that is better prepared to detect, respond to, and recover from increasingly sophisticated and AI-assisted cyber threats.
Further Reading & Resources
https://www.sophos.com/en-us/blog/uncensored-luciferus-ai-service-advertised-underground - Sophos Newsroom
Source: Sophos Limited
Need help turning this into action?
Speak with JK Tech about practical next steps, technology planning, cyber resilience, deployment, and business-ready IT implementation.
Contact Us
Need help with your enquiry? Speak with JK Tech to get more information.
Tell us what you need, and our team will get back to you shortly.