Loading story…
Palo Alto Networks Unit 42 reported on Automated Libra, a threat activity cluster that uses automation and likely AI-assisted social engineering to support cyber intrusions. The reporting indicates the actor focuses on manipulating targets through convincing interactions rather than relying solely on malware delivery, highlighting a growing operational model in which adversaries blend traditional intrusion tradecraft with scalable, automated engagement.
The activity underscores how threat actors are adapting generative AI and workflow automation to improve phishing, impersonation, and other human-targeted tactics that can lead to credential theft or broader compromise. Unit 42’s publication frames Automated Libra as part of a wider shift in the threat landscape, where attackers use automated tooling to increase the speed, volume, and plausibility of social-engineering operations against organizations.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published a research article titled "atoms/automated-libra." No additional incident details are provided in the reference content.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and industry research indicate that **generative AI is becoming embedded in offensive cyber operations**, especially in phishing and other lower-skill attack workflows. Kaseya reported that AI-generated phishing became the default in 2025, citing widespread use of AI in phishing and BEC, higher click-through rates, and improved message quality that removes traditional warning signs such as poor grammar and repetitive templates. Bridewell's survey of UK critical national infrastructure organizations similarly found that **AI-related cyber risk** has become a top concern, with respondents linking it to more scalable phishing, BEC, and malware activity while also reporting broad exposure to cyber incidents and operational disruption. An SC Media commentary pushed the trend further, arguing that AI is also reducing the expertise required for more advanced intrusions by describing a reported campaign against Mexican government entities in which an attacker allegedly used multiple chatbots for planning and troubleshooting during a prolonged data theft operation. That account is presented as opinion rather than a formal incident disclosure, but it aligns with the broader pattern that **LLMs are lowering the barrier to entry for cybercrime** and making attacks harder to detect because defenders must increasingly assess intent and context rather than rely on legacy indicators alone.
Jun 29, 2026
Palo Alto Networks' Unit 42 reported that artificial intelligence is currently serving mainly as a force multiplier for attackers, speeding up and scaling established intrusion workflows rather than introducing entirely new attack methods. Drawing on incident response investigations, the report said threat actors still rely on familiar tactics including **credential theft**, **phishing**, exploitation of known vulnerabilities, and **ransomware**, while using AI to accelerate malware development, automate content generation, and streamline reconnaissance. Unit 42 leaders Andy Piazza and Richard Emerson said AI-enabled attacks have not yet required enterprises to redesign core defense strategies, but warned that broader attacker adoption could strain detect-and-respond operations and raise the value of prevention-focused controls. The report also pointed to emerging activity including **AI-assisted malware**, malware that queries **LLM** or **MCP** servers for command-and-control guidance, **agentic ransomware**, and **token jacking** aimed at cloud AI services and LLM API credentials.
Jul 17, 2026
Threat researchers and industry reports say cybercriminals are increasingly using **AI-powered tooling** to improve phishing, social engineering, credential theft, malware development, and activity inside compromised networks. Sophos found growing discussion across underground forums and marketplaces about large language models being used for multilingual lures, deepfake-enabled fraud, and other attack workflows, while ReliaQuest reported that AI has made attacks cheaper, faster to scale, easier to customize, and harder to detect without fundamentally changing core intrusion tradecraft. Proofpoint’s 2026 ransomware survey found **65%** of victim organizations believed AI increased attack effectiveness, with human interaction frequently enabling initial access through malicious links, attachments, and credential harvesting. Researchers said AI is now being applied to industrial-scale phishing, identity fabrication, phishing pages, web shells, credential harvesters, code padding to evade static analysis, and fake AI-branded downloads, while some criminals also worry automation could displace manual operators or degrade criminal product quality. Defenders were urged to reinforce core controls including **MFA**, passkeys, patching, behavioral detection, environment visibility, and defense-in-depth as AI-assisted attacks become more convincing and covert.
Aug 11, 2026