Forum seller offers MONST3R-AI, an autonomous scanner billed to the owners of stolen AI keys

Bitsight's position is that the tool would work even if only a small share of those findings were accurate, and it expects stolen keys to be sold for no other purpose than powering scanners of this kind ^[20]. Help Net Security's account does not describe a victim who has been billed.

Stolen keys are one of two routes in the research. Skilled actors are moving toward open-weights models such as GLM and DeepSeek, and mentions of them climbed sharply ^[5]. CloseRouter, a reseller, offered both open-weights and commercial models at roughly ten cents per million tokens ^[6]. For GLM it listed input at $0.053 per million tokens, where the official API charges $1.12 ^[6], about 21 times as much ^[17].

Mention counts measure forum talk. Over the same window, talk about AI rose 45 percent, ransomware mentions dropped 49 percent and phishing mentions were down 8.5 percent ^[7]. Bitsight says part of the ransomware decline probably reflects takedowns and a shift into closed channels, meaning some of the gap is attention moving from one topic to another ^[8].

Criminal chatbots sold under a brand name are fading. Mentions of WormGPT and FraudGPT slipped 8.7 percent ^[9], and a breach of WormGPT earlier this year exposed the emails, payment data and subscription tiers of about 19,000 users ^[10]. Meanwhile one actor demonstrated an agent working the IDA Pro disassembler to locate a buffer overflow and write up an exploit plan, while another broke into an enterprise Notion account with an agent that automates a browser ^[21]. We think MONST3R-AI is one product of a wider move to agents, and Bitsight's counts support that read better than the seller's dashboard does.

FakeGit is its own campaign, separate from the MONST3R-AI sale. More than 800 of its roughly 7,600 repositories posed as AI skills or MCP servers, including a lookalike "Docker MCP Gateway", to get indexed in public AI registries ^[12]. That is roughly a tenth of the campaign ^[18].

Bitsight's other advice is to block local coding agents from sensitive directories and shell commands without human approval, and to establish what normal human login rates look like on Notion, Slack and GitHub, because agents running headless browsers operate at a noticeably different pace ^[15].