Loading story…
Recent research and industry analysis highlight the growing influence of large language models (LLMs) in both cyber defense and cybercrime. A study from the University of Bari demonstrated that LLM-generated phishing awareness training can measurably improve users' ability to detect phishing emails, with participants showing increased recall, precision, and overall detection skill after receiving AI-tailored lessons. The research found that even simple prompting methods, which personalize training based on user profiles, were as effective as more elaborate approaches, suggesting that LLMs can efficiently enhance phishing resilience through adaptive, scalable training content.
Meanwhile, security researchers have observed that LLMs are accelerating the operational tempo of ransomware groups rather than fundamentally changing their tactics. LLMs are enabling lower-skilled threat actors to develop functional tools and infrastructure more easily, contributing to a proliferation of smaller, agile ransomware crews. These models also facilitate faster reconnaissance, phishing, and negotiation processes, and their multilingual capabilities expand the reach of cybercriminals. While LLMs have not introduced revolutionary new attack techniques, defenders should anticipate continued incremental efficiency gains among adversaries leveraging AI-driven tools.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers at the University of Bari conducted two controlled studies involving 480 participants to test whether LLM-generated phishing awareness training improves users' ability to detect phishing emails. The studies found measurable gains in recall, precision, and overall phishing detection performance, while showing that generic training performed similarly to more personalized approaches.
SentinelLABS reported that threat actors are increasingly using LLMs to speed up ransomware-related tasks such as phishing, data triage, negotiation, malware enhancement, and brand spoofing. The report said LLMs are acting as an operational accelerator rather than creating fundamentally new ransomware tactics, while contributing to a more fragmented and faster-moving extortion ecosystem.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly leveraging generative AI and large language models (LLMs) to enhance the sophistication, scale, and impact of their attacks. Reports highlight a dramatic rise in advanced phishing, digital fraud, and malware development, with AI enabling attackers to automate social engineering, generate convincing fake identities, and bypass traditional security controls. The use of AI has led to a significant increase in phishing email volume and a 180% surge in advanced fraud attacks, as criminals deploy autonomous bots and deepfake technologies to evade detection and inflict greater damage. Security researchers have observed malware authors integrating LLMs directly into their tools, allowing malicious code to rewrite itself or generate new commands at runtime, further complicating detection efforts. These developments mark a shift from low-effort, opportunistic attacks to highly engineered campaigns that require more resources to execute but yield far greater impact. The rapid adoption of AI by threat actors underscores the urgent need for organizations to reassess their defenses and adapt to the evolving threat landscape.
Jun 29, 2026
Security researchers have identified a new trend in which threat actors are embedding large language models (LLMs) directly into malware to enhance its capabilities and evade detection. Akamai Hunt discovered a novel malware strain that disguises its command and control (C2) traffic as legitimate LLM API requests, using Base64-encoded strings to communicate and potentially allowing attackers full control over compromised systems and data exfiltration. This approach enables malicious traffic to blend in with normal AI-related network activity, making detection more challenging for defenders. Further analysis and industry reporting highlight that malware families such as PromptFlux and PromptSteal are now querying LLMs mid-execution to dynamically alter their behavior, obfuscate code, and generate system commands on demand. PromptFlux, for example, uses the Gemini API to regularly re-obfuscate its source code, while PromptSteal leverages the Hugging Face API for real-time reconnaissance and exfiltration commands. These developments underscore the need for organizations to adapt their security controls and detection strategies to address the evolving threat landscape where AI and LLMs are weaponized by attackers.
Jul 12, 2026
The widespread integration of large language models (LLMs) into enterprise environments is introducing new security risks at every layer of the technology stack. Security leaders are being urged to rethink traditional trust boundaries, as LLMs can alter assumptions about data handling, application behavior, and internal controls. Key risks include prompt injection, sensitive data leakage through inputs and outputs, and fragmented ownership of LLM-related security responsibilities. Experts emphasize the need to treat LLMs as untrusted compute and to enforce explicit policy and validation layers, rather than relying solely on prompt engineering or fine-tuning. Meanwhile, cybercriminals are actively exploiting the popularity of LLMs by selling discounted access to mainstream AI tools such as ChatGPT, Perplexity, and Gemini on underground forums. These tools are being used by threat actors for a range of malicious activities, including phishing, reconnaissance, and automating cybercrime operations. The criminal use of LLMs lowers the barrier to entry for less-skilled attackers and enables more efficient execution of threat campaigns, highlighting the dual challenge of securing enterprise LLM deployments while monitoring their abuse in the cybercriminal ecosystem.
Jun 29, 2026