Flash Report: Unrestricted LLM Gaining Traction in Underground

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 7:00 AM (EST) on November 6, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

• On October 20, 2026, ZeroFox noted the emergence of an unrestricted large language model (LLM) service called “Dikaya”. The service, which has since gained traction on Telegram and the Exploit forum, advertises access to models with safety alignment and refusal mechanisms removed.
• Dikaya’s offerings reportedly include GLM-5.3 and DeepSeek-V4.1 variants modified through “abliteration”—a technique that identifies the internal direction in a model associated with refusing requests and removes it from the model’s weights.
• ZeroFox assesses that Dikaya is likely to lower the barrier to entry for less-skilled threat actors. Actors who previously could not write or adapt malicious code or were blocked by commercial LLM safeguards can now draft tooling, phishing content, and scripts quickly without crafting jailbreak prompts.
• Defenders should expect a rise in the volume and speed of tooling and lure development—particularly from lower-tier actors—rather than a new class of attack.

Overview

On October 20, 2026, ZeroFox noted the emergence of an unrestricted large language model (LLM) service called “Dikaya”. The service, which has since gained traction on Telegram and the Exploit forum, advertises access to models with safety alignment and refusal mechanisms removed.

ZeroFox assesses Dikaya’s operator to be moderately credible based on their limited activity on the Exploit forum.

Dikaya’s offerings reportedly include GLM-5.3 and DeepSeek-V4.1 variants modified through “abliteration”—a technique that identifies the internal direction in a model associated with refusing requests and removes it from the model’s weights. Unlike jailbroken models, which depend on prompts that providers can patch, abliterated models have no refusal behavior left to bypass. Further, unlike custom models, they do not require resource-intensive retraining.

As of writing, ZeroFox did not observe any pricing listed for the service.

The service is almost certainly dual-use. Security researchers will likely value an unrestricted model for red teaming and exploit research, but the same capability will almost certainly allow threat actors to generate working exploit code, malware, and other malicious tooling on request.

ZeroFox assesses that Dikaya is likely to lower the barrier to entry for less-skilled threat actors. Actors who previously could not write or adapt malicious code or were blocked by commercial LLM safeguards can now draft tooling, phishing content, and scripts quickly without crafting jailbreak prompts. More experienced actors are likely to use the service to shorten development cycles and iterate on existing tools.

Removing refusals does not add capability. Output quality remains limited by the underlying models, and ZeroFox has not independently verified Dikaya’s claims or tested its output. Abliteration can also degrade model performance.

Because the restrictions are removed from the weights, no provider-side safeguard can be tightened or revoked. A takedown of Dikaya would not remove the capability, as abliterated variants of open-weight models can be reproduced by any actor with the technical skills. ZeroFox assesses that similar services will likely emerge and compete in deep and dark web (DDW) communities.

Defenders should expect a rise in the volume and speed of tooling and lure development—particularly from lower-tier actors—rather than a new class of attack. Detection that relies on indicators of low-effort or unpolished content (such as poor phishing grammar or crude code) is likely to become less reliable. ZeroFox will continue to monitor Dikaya and similar services for evidence of operational use.

Recommendations

• Develop a comprehensive incident response strategy.
• Deploy a holistic patch management process, and ensure all IT assets are patched with the latest software updates as quickly as possible.
• Adopt a Zero-Trust cybersecurity architecture based upon a principle of least privilege.
• Implement network segmentation to separate resources by sensitivity and/or function.
• Ensure critical, proprietary, or sensitive data is always backed up to secure, off-site, or cloud servers at least once per year—and ideally more frequently.
• Implement secure password policies, phishing-resistant multi-factor authentication (MFA), and unique credentials.
• Configure email servers to block emails with malicious indicators, and deploy authentication protocols to prevent spoofed emails.
• Proactively monitor for compromised accounts and credentials being brokered in DDW forums.
• Leverage cyber threat intelligence to inform the detection of relevant cyber threats and associated tactics, techniques, and procedures (TTPs).