Xanthorox
Xanthorox is an AI-enabled offensive cyber tool advertised for cyberattack and privacy-violation activities. The provided content places its emergence in April 2025 and lists it alongside underground or openly distributed malicious LLM-style tools such as WormGPT, GhostGPT, FraudGPT, EvilGPT, KawaiiGPT, HexStrike AI, and BruteForce AI. It is described as being marketed as a custom AI for cyber offensive purposes and as having no content filter, but reporting cited in the content states that investigation found it was powered by several third-party and commercial AI products, including Gemini, rather than being a novel proprietary model. More broadly, the content characterizes tools in this category as supporting offensive workflows such as phishing automation, malware development, reconnaissance, code generation, vulnerability exploitation, and privacy-invasive activity. No specific infection vector, malware payload behavior, victimology, targeted industry, threat actor attribution, or concrete IOCs unique to Xanthorox are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Initial Access
1 technique
Initial Access
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cyber-oriented LLM marketed on underground forums for offensive use without content filtering; described as useful for phishing content or simple malware stubs.
AI-enabled tool used to support cyber attacks and privacy-violating activity.
AI-based hacking tool referenced as part of the ecosystem of offensive AI tools distributed on dark web and other platforms.
Advertised as an AI-enabled offensive cyber toolkit; investigation indicates it is largely a wrapper around third-party/commercial AI services (including Gemini) rather than a standalone model.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.