Loading story…
Google Threat Intelligence Group reported that threat actors are increasingly incorporating artificial intelligence tools into malicious operations, using them to improve phishing, social engineering, research, translation, and content generation. The activity reflects a broader shift in attacker tradecraft, with AI helping operators produce more convincing lures, refine messaging for different targets and languages, and accelerate routine tasks that support intrusion campaigns.
The report indicates that AI adoption by threat actors is advancing but remains largely focused on productivity gains rather than replacing core offensive capabilities. Attackers are using these tools to scale existing workflows and lower the effort required for reconnaissance and deception, while defenders face a growing volume of more polished malicious content and a faster operational tempo from both cybercriminal and state-linked actors.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Google Cloud published a GTIG AI Threat Tracker blog post on advances in threat actor usage of AI tools. No additional event details are available in the provided reference content.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group reported that threat actors are moving beyond experimentation with artificial intelligence and are increasingly integrating AI into real-world malicious operations. The update highlights adversarial interest in **model distillation**, which can reproduce capabilities of larger systems in smaller, cheaper models, alongside continued testing of AI for tasks such as content generation, workflow acceleration, and operational support. The report indicates that AI adoption by attackers remains evolutionary rather than revolutionary, with actors using the technology to improve efficiency instead of fundamentally changing tradecraft. Google’s tracking suggests the most notable developments are the refinement of distilled models, broader experimentation across criminal and state-linked ecosystems, and the continued embedding of AI into existing intrusion, influence, and cyber-enabled activity.
Jun 29, 2026
Security reporting and industry research indicate that **generative AI is becoming embedded in offensive cyber operations**, especially in phishing and other lower-skill attack workflows. Kaseya reported that AI-generated phishing became the default in 2025, citing widespread use of AI in phishing and BEC, higher click-through rates, and improved message quality that removes traditional warning signs such as poor grammar and repetitive templates. Bridewell's survey of UK critical national infrastructure organizations similarly found that **AI-related cyber risk** has become a top concern, with respondents linking it to more scalable phishing, BEC, and malware activity while also reporting broad exposure to cyber incidents and operational disruption. An SC Media commentary pushed the trend further, arguing that AI is also reducing the expertise required for more advanced intrusions by describing a reported campaign against Mexican government entities in which an attacker allegedly used multiple chatbots for planning and troubleshooting during a prolonged data theft operation. That account is presented as opinion rather than a formal incident disclosure, but it aligns with the broader pattern that **LLMs are lowering the barrier to entry for cybercrime** and making attacks harder to detect because defenders must increasingly assess intent and context rather than rely on legacy indicators alone.
Jun 29, 2026
Threat researchers and industry reports say cybercriminals are increasingly using **AI-powered tooling** to improve phishing, social engineering, credential theft, malware development, and activity inside compromised networks. Sophos found growing discussion across underground forums and marketplaces about large language models being used for multilingual lures, deepfake-enabled fraud, and other attack workflows, while ReliaQuest reported that AI has made attacks cheaper, faster to scale, easier to customize, and harder to detect without fundamentally changing core intrusion tradecraft. Proofpoint’s 2026 ransomware survey found **65%** of victim organizations believed AI increased attack effectiveness, with human interaction frequently enabling initial access through malicious links, attachments, and credential harvesting. Researchers said AI is now being applied to industrial-scale phishing, identity fabrication, phishing pages, web shells, credential harvesters, code padding to evade static analysis, and fake AI-branded downloads, while some criminals also worry automation could displace manual operators or degrade criminal product quality. Defenders were urged to reinforce core controls including **MFA**, passkeys, patching, behavioral detection, environment visibility, and defense-in-depth as AI-assisted attacks become more convincing and covert.
Aug 11, 2026