Loading threat actor…
Xanthorox AI is a malicious offensive AI platform marketed in cybercriminal channels as a modular, enterprise-grade service for offensive cyber operations. It has been described as comprising multiple specialized AI components for code generation, image analysis, social-engineering content creation, voice interaction, and real-time reconnaissance across numerous search engines. The platform is positioned as a subscription-based capability intended to lower the barrier to entry for cybercrime while also accelerating workflow for more capable operators. Xanthorox AI is associated with the broader ecosystem of weaponized large language models used to support attack development and operational scaling. Its reported functionality aligns with reconnaissance, generation of offensive tooling, and support for social-engineering activity. In the wider context of AI-enabled cybercrime, such platforms are used to speed exploit development, automate attack preparation, improve evasion, and compress the time between vulnerability disclosure and operational abuse. Available information supports treating Xanthorox AI as a criminal enablement platform rather than a state-linked intrusion set or a conventionally tracked named actor group. No high-confidence attribution to a specific country, victim geography, or industry targeting is currently available from the supplied facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.