Loading story…
Microsoft Threat Intelligence reported that threat actors are increasingly using generative AI as a “force multiplier” across the cyberattack lifecycle—speeding up reconnaissance, phishing and social engineering, infrastructure setup, malware development/debugging, and post-compromise tasks such as summarizing stolen data and assisting with scripting. The report emphasizes that most observed malicious AI use today centers on language models for producing text, code, and media, reducing technical friction while human operators retain control over targeting and execution.
Microsoft highlighted North Korean activity as a prominent example, stating that groups it tracks as Jasper Sleet (Storm-0287), Coral Sleet (Storm-1877), and Sapphire Sleet are using AI to scale “fake remote worker” operations by rapidly generating realistic personas (names, resumes, communications) tailored to specific job markets and roles. Reported tactics include researching job postings (e.g., on Upwork) to align fabricated profiles with in-demand skills, using AI-generated multilingual lures that mimic internal corporate communications, and employing AI-enabled media manipulation such as Faceswap to insert operatives’ faces into stolen identity documents, alongside AI-driven impersonation and real-time voice modulation to improve social engineering and access persistence.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft said threat actors are increasingly using generative AI as a force multiplier for reconnaissance, phishing, infrastructure development, malware-related tasks, and post-compromise operations. It also warned that while most current use is generative, attackers are beginning to experiment with agentic AI for more autonomous workflows.
Microsoft Threat Intelligence reported that North Korean-linked groups including Coral Sleet, Sapphire Sleet, and Jasper Sleet are using generative AI to scale long-running fake remote worker schemes at global companies. The report said AI is being used to build tailored personas, support hiring deception, maintain access after employment, and assist post-compromise activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
socradar.io
Open sourcebleepingcomputer.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft-linked reporting says **North Korean threat actors** are using **AI** to scale and refine long-running “fake IT worker” schemes, where operatives pose as legitimate remote hires to obtain *authorized* access inside victim organizations. The activity is attributed to DPRK-linked clusters **Jasper Sleet** and **Coral Sleet**, with AI used to improve identity fabrication and maintenance (including face/voice manipulation) and to sustain day-to-day communications that help keep fraudulent personas credible, enabling “sustained, large-scale misuse of legitimate access.” Separately, reporting on suspected DPRK-linked intrusions describes a coordinated campaign against **cryptocurrency organizations** spanning staking platforms, exchange software providers, and exchanges, with theft of **source code, private keys, and cloud secrets**. Investigators described two primary access paths: exploitation of `CVE-2025-55182` in the *React2Shell* framework (including mass scanning and WAF-bypass techniques) and the use of **pre-obtained valid AWS access tokens** to move directly into cloud enumeration; researchers also recovered artifacts from attacker infrastructure (e.g., shell history, archived code, and tool configurations) that provided visibility into post-compromise activity and C2 setup.
Jun 29, 2026
Underground operators are increasingly packaging generative AI into **criminal AI-as-a-service** offerings that support phishing, fraud, impersonation, malware modification, translation, and post-breach data analysis. Reporting on the market describes branded tools such as **FraudGPT**, **GhostGPT**, and **WormGPT**, but says many are little more than wrappers around legitimate models, stolen accounts, or hijacked API keys rather than fully autonomous hacking platforms. Researchers also highlighted a parallel market for deepfake-enabled abuse, including voice cloning, face swaps, fake selfies, and virtual camera injection used for KYC bypass, synthetic identity fraud, and onboarding scams. Sophos separately identified a malware development lab using AI tools including **Cursor** and **Claude Opus** to speed ransomware-related coding, payload refinement, and evasion testing. The framework reportedly generated Python-driven Rust and Go malware modules, customized **Cobalt Strike** profiles, Telegram-based command channels, Cloudflare Worker intermediaries for command-and-control traffic, code-injection scripts targeting legitimate Windows applications, and AI-assisted Active Directory reconnaissance. Researchers said the operation tested nearly 80 modules against more than 70 evasion methods across Sophos, CrowdStrike, and Microsoft defenses, reinforcing that the immediate risk is not autonomous AI malware but faster, cheaper, and more scalable attacker workflows.
Jun 29, 2026
Microsoft Threat Intelligence reported that threat actors are exploiting the popularity of AI platforms including **ChatGPT**, **Claude**, **DeepSeek**, and **Flux Pro AI** to drive phishing, malvertising, and malware delivery rather than compromising the vendors themselves. One ChatGPT-themed campaign, aimed largely at South African users, used payment-update emails and redirect chains through legitimate services to a compromised site that harvested personal and credit card data. A separate Claude-themed operation targeted more than 2,000 organizations and likely used adversary-in-the-middle techniques to steal Microsoft sign-in credentials and authentication tokens. Microsoft also linked large-scale AI-themed malvertising to **Storm-3075**, which pushed fake AI plugin downloads and delivered malware including **Vidar Stealer**, **Lumma Stealer**, **Hijack Loader**, and **Oyster**, with parts of the chain tied to **Fox Tempest** malware-signing services. In another case, attackers created a fake **DeepSeek V4** GitHub repository within hours of the model’s launch, using copied benchmark data, official-looking branding, SEO tactics, and rotating payloads to distribute **Vidar** and **GhostSocks** malware before GitHub removed the infrastructure. Microsoft said it revoked certificates, disrupted Fox Tempest infrastructure with partners, and coordinated takedowns, while urging defenders to strengthen MFA, conditional access, browser protections, and endpoint and email defenses.
Jun 29, 2026