Cybercriminals are building a service economy around existing AI tools, rather than having to build models themselves, according to a report by cybersecurity intelligence company Flashpoint. That could make familiar fraud, phishing and impersonation attacks easier for less technically skilled criminals to carry out.
Watch Desk analysis
What happened
Digital Journal reports that Flashpoint tracked more than 2.3 million posts discussing AI across illicit forums, marketplaces and chat applications in a single month, including 1.4 million on Telegram. The report also identified almost 64,000 posts advertising AI tools intended to get around know-your-customer checks. The described techniques include synthetic video and cloned voices used to impersonate real people.
Flashpoint’s findings, as reported by Digital Journal, point to criminals sharing prompts, jailbreak techniques and access to models they perceive as less restricted. The shift is less about inventing a new kind of crime than making established fraud methods easier to reuse and scale.
Why it matters
For businesses, a familiar face or voice on a video call is no longer strong proof that a request is genuine. A convincing impersonation could be used to push a payment, change account details or bypass identity checks. The practical defence is to verify the request separately, using a trusted channel, rather than treating the communication itself as authorisation.
The report’s numbers describe posts and advertised tools, not how many attacks succeeded. But the service-economy finding matters: attackers may be able to acquire capabilities and instructions instead of developing them from scratch.
Our read
The key change is access. When prompts, jailbreaks and deepfake methods circulate as ready-to-use services, the barrier to trying an AI-assisted scam may fall. Organisations should make independent verification routine for high-risk requests, not rely on staff spotting an unnatural voice or image. That is less glamorous than a new detection dashboard, and rather more useful.
What to watch
- Whether further reporting or the underlying Flashpoint report clarifies how its post counts were collected.
- How often attackers use these tools in successful fraud, rather than merely discussing or advertising them.
- Whether businesses strengthen independent checks for payments, account recovery and identity changes.
Discussion spark: For high-risk requests, should companies require a second-channel check every time, even if it slows down legitimate work?
Sources and evidence
- AI-as-a-service: Cybercriminals are trading prompts and deepfake tools instead of building models – Digital Journal (29 October 2026, 22:55 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.