Sale of AI tools for ransomware explodes 3,800% in three months – and WormGPT leads

The clandestine ransomware market is experiencing a silent revolution: artificial intelligence tools have become the new commodity. According to a recent review of illegal forums and marketplaces, the number of announcements and discussions about AI jumped from only 38 in December 2025 to impressive 1,486 in February 2026 — a growth of nearly 3,800% in three months. The main highlight is 'WormGPT', which has consolidated as the most popular brand, although it is used by multiple different operators.

What explains the boom of AI tools for ransomware in cyber crime?

The main reason is the democratization of the attacks. Tools based on language models allow criminals with little or no technical ability to create convincing phishing emails, generate custom malicious code, and even automate ransom trading. Rather, mastering these capabilities required a high investment in learning and infrastructure. Now, anyone with access to a clandestine market can buy an AI kit for a few dollars or cryptocurrencies. The original source, the CSO Online, highlights that this trend drastically reduces the entry barrier for new cyber criminals.

How did WormGPT become the main AI tool for ransomware?

Unlike many think, WormGPT is not a single software, but a label or brand that several vendors have come to use for their products. Forum analysis shows that the term 'WormGPT' appears in more than 60% of AI-related posts for ransomware. This created an effect of 'own brand' in the digital underworld: buyers look for this keyword as well as looking for 'Free Market' or 'Amazon' in the legal market. Success is due to the association with malicious content generation capabilities — and to the fact that suppliers compete in price, further lowering the cost. Meanwhile, researchers have already demonstrated how open-weight AI models can be used to create corporate worms that spread on corporate networks alone — read more on IA open-weight creates corporate worm that spreads itself on corporate networks.

Why does the growth of AI for ransomware alert Brazilian companies?

Brazil is one of the countries most affected by ransomware attacks, and AI commoditization means that the volume and sophistication of attacks tend to grow exponentially. Tools like WormGPT can be adjusted to write emails in perfect English, imitate the tone of corporate communications, and even simulate links with synthetic voice. For developers, the risk is also direct: AI-generated codes can contain backdoors or intentional vulnerabilities that go unnoticed in hasty reviews. The recommendation of experts is to redouble attention in safety solutions based on defensive AI, such as fault detection systems and advanced email filters.

Frequently Asked Questions about AI for ransomware

What is WormGPT?

It is a generic brand used in clandestine forums to designate AI tools aimed at cyber crime, especially ransomware. It is not a single software, but a set of templates and scripts sold by different operators.

Are these tools really effective for attacks?

Yes, according to the analysis, they can generate highly personalized phishing and functional malicious code. However, effectiveness depends on the quality of the base model and the adjustment made by the seller — some are rudimentary, but sales growth indicates that many buyers get results.

How can companies prepare for this new wave?

Invest in security solutions that use proactive AI, such as behavioral antivirus and employee training with modern phishing simulations. In addition, maintaining software update policies and offline backup reduces the impact of attacks.