Black Market Bots: The Shadow Economy of Stolen AI Accounts

When you purchase a ChatGPT Plus or Claude Pro subscription, you probably don’t imagine your account credentials being hawked in a Telegram group to buyers in Russia, Iran, or North Korea. Yet, as AI tools become indispensable for businesses and individuals, cybercriminals are cashing in - turning paid AI accounts into the latest must-have item in the digital black market.

Fast Facts

• Premium AI accounts (ChatGPT, Claude, Copilot, etc.) are increasingly sold on underground forums and Telegram channels.
• Cybercriminals obtain access via stolen credentials, bulk account creation, exposed API keys, and abuse of free trials.
• Underground listings boast lower prices, bundled services, and “no limits” access - often targeting sanction-bypassed countries.
• AI accounts are used to automate phishing, generate scam content, and enhance social engineering attacks.
• This trend is lowering the barrier to AI-powered crime, making advanced tools accessible to a wider range of threat actors.

The New Currency of Cybercrime

AI platforms are now woven into the fabric of daily work - writing code, generating reports, and analyzing data. But as their value grows, so does their desirability in the criminal underworld. Flare analysts have uncovered a thriving ecosystem where premium AI logins are resold, bundled, and marketed with the same slick language as any legitimate SaaS product.

So, how do bad actors get their hands on these accounts? Common tactics include using leaked credentials from aged Gmail or Outlook accounts, exploiting exposed API keys, bypassing verification with virtual phone numbers, and abusing promotional trials. Sometimes, access is shared among multiple buyers, or backend developer keys are offered for more advanced abuse.

Pricing is a key lure. While an official subscription can cost $20 or more per month, underground sellers offer steep discounts or bundles - especially attractive in regions where access is blocked or payment is impossible due to sanctions. Posts promise “full access,” “no limits,” and even “unrestricted API,” though the veracity of these claims is often questionable. Still, the promise of fewer restrictions is enough to draw in buyers looking to evade detection or maximize usage.

The motivations are clear: fraudsters use AI to generate convincing phishing emails, scam scripts, and social engineering content in multiple languages. Europol and major cybersecurity firms warn that AI-powered campaigns are making attacks faster, more sophisticated, and harder to detect. Even low-skilled criminals can now wield the power of advanced AI models, fueling a new wave of scalable, automated cybercrime.

This underground market is growing fast, with AI accounts often sold alongside other digital assets like remote desktops and VPS servers. The ease and affordability of these offerings mean that more threat actors - regardless of technical skill - can tap into AI’s capabilities for malicious purposes.

Conclusion: The Next Frontier in Cybercrime

As AI transforms work and creativity, its shadow stretches into the criminal underground. The resale of premium AI accounts is not just a passing fad - it signals a shift in how digital tools are weaponized and democratized for cybercrime. Organizations must adapt quickly: enabling strong authentication, monitoring for leaked credentials, and training users about the risks of shared or illegitimate AI access. The black market for AI is open for business - and every account is a potential target.

WIKICROOK

• API key: An API key is a unique code that lets programs access data or services. If not properly secured, it can pose a cybersecurity risk.
• Credential theft: Credential theft occurs when hackers steal usernames and passwords, often via phishing or data breaches, to illegally access online accounts.
• Social engineering: Social engineering is the use of deception by hackers to trick people into revealing confidential information or providing unauthorized system access.
• Bulk account creation: Bulk account creation is the automated generation of many user profiles, often used to bypass controls and enable spam or malicious activity.
• Sanctions bypass: Sanctions bypass is the act of evading government restrictions on digital services, often using VPNs or proxies to access blocked content.