Hackers Promote New Nytheon AI Blackhat Tool on Prominent Hacking Forums

Cybersecurity researchers at Cato CTRL have identified a sophisticated new threat in the form of Nytheon AI, an uncensored artificial intelligence platform specifically designed for malicious activities that is being actively promoted on popular hacking forums and Telegram channels.

This discovery represents a significant escalation in the weaponization of large language models by cybercriminals, moving beyond simple jailbroken chatbots to comprehensive AI-powered attack platforms.

Unlike previous malicious AI tools such as WormGPT, BlackHatGPT, and FraudGPT that relied on single jailbroken models, Nytheon AI operates as a sophisticated end-to-end platform combining multiple specialized AI models.

The platform operates on the Tor network and features six distinct models designed for different attack vectors: Nytheon Coder and Nytheon Coder R1 for malicious code generation, Nytheon GMA for document manipulation and translation, Nytheon Vision for image-to-text recognition, and Nytheon AI as a control model.

The platform’s operators have assembled a portfolio of open-source checkpoints, including an 18.4 billion parameter model derived from Meta’s Llama 3.2 and a 4.3 billion parameter variant of Google’s Gemma 3.

Crucially, five of the six models share an identical system prompt that deliberately disables safety layers and mandates compliance with illegal requests, enabling the production of malicious content without requiring external jailbreaks.

Nytheon AI Blackhat Tool

The technical sophistication of Nytheon AI sets it apart from typical dark web offerings.

Built using modern SaaS architecture with SvelteKit frontend and FastAPI-style backend, the platform resembles legitimate enterprise software rather than hastily assembled criminal tools.

Recent changelog updates reveal rapid development cycles with features including multimodal data ingestion, pluggable tool execution, and real-time knowledge re-indexing capabilities.

The platform’s architectural design allows users to drag-and-drop screenshots or documents for OCR processing, integrate voice-to-text functionality, and connect external APIs through OpenAPI specifications.

This means a single prompt can both generate malicious content and immediately execute it through connected tools, dramatically streamlining attack workflows.

Global Cybercrime Market

Intelligence analysis indicates the platform is operated by Russian-speaking individuals from post-Soviet countries, based on linguistic patterns and cultural references observed in promotional materials.

Organizations are advised to implement enhanced threat detection capabilities, strengthen access controls through zero-trust architectures, and conduct AI-enhanced security awareness training to defend against this new generation of AI-powered threats.

The service has been advertised on XSS, a popular Russian hacking forum, and distributed through multiple Telegram channels.

Security experts warn that the platform’s capabilities enable threat actors to conduct sophisticated attacks including tailored spear-phishing campaigns, polymorphic malware development, deepfake document creation, and API-driven automated attacks.

The combination of multiple AI models under a unified interface represents a significant evolution in cybercriminal tooling.

The emergence of Nytheon AI demonstrates that cybercriminals are rapidly adopting and weaponizing cutting-edge AI technologies at an unprecedented scale.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

The post Hackers Promote New Nytheon AI Blackhat Tool on Prominent Hacking Forums appeared first on Cyber Security News.