Criminal AI-as-a-Service in 2026: How the Underground Market Is Operationalizing Cybercrime

Rapid7 published a set of posts covering multiple high-impact developments in June 2026: (1) The underground market is operationalizing criminal AI-as-a-service—criminals are integrating generative models into phishing, profiling, malware modification, fraud, and post‑breach data processing via jailbreaks, stolen accounts, prompt packs, Telegram bots, and open‑weight models. (2) Rapid7 built an automated threat‑hunting pipeline that uses LLMs to extract behaviors, map to MITRE ATT&CK, and generate tool queries to speed analyst workflows. (3) Two critical Ivanti Sentry vulnerabilities were disl