Sophos X-Ops has identified Luciferus, an uncensored AI subscription service being promoted on an underground cybercrime forum as a tool without the ethical restrictions found in mainstream AI services.
Researchers from the Sophos Counter Threat Unit (CTU) observed a forum persona advertising Luciferus on August 24, 2026. The service claims to use a proprietary large language model with 120 billion parameters, although Sophos said it has not independently verified the model’s architecture, parameter count, performance, privacy claims, or advertised capabilities.
The research highlights the growing commercialization of AI within the underground cybercrime economy. Threat actors are increasingly offering AI services alongside established cybercrime tools such as malware, phishing kits, ransomware, and brokered access.
Luciferus is marketed as an uncensored local large language model, positioning it as an alternative to attempts to bypass safeguards on mainstream AI systems.
Sophos CTU researchers also observed the service’s Luciferus Junior model responding to a request to generate a simple Python-based remote access trojan, illustrating how such services could potentially lower technical barriers to developing malicious tools.
Sophos said the development reflects a broader shift in which AI capabilities are being packaged, tiered, and sold as commercial services within underground communities.
