Loading story…
Palo Alto Networks' Unit 42 reported that artificial intelligence is currently serving mainly as a force multiplier for attackers, speeding up and scaling established intrusion workflows rather than introducing entirely new attack methods. Drawing on incident response investigations, the report said threat actors still rely on familiar tactics including credential theft, phishing, exploitation of known vulnerabilities, and ransomware, while using AI to accelerate malware development, automate content generation, and streamline reconnaissance.
Unit 42 leaders Andy Piazza and Richard Emerson said AI-enabled attacks have not yet required enterprises to redesign core defense strategies, but warned that broader attacker adoption could strain detect-and-respond operations and raise the value of prevention-focused controls. The report also pointed to emerging activity including AI-assisted malware, malware that queries LLM or MCP servers for command-and-control guidance, agentic ransomware, and token jacking aimed at cloud AI services and LLM API credentials.
Track how attackers are adapting to this technology.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers and industry reports say cybercriminals are increasingly using **AI-powered tooling** to improve phishing, social engineering, credential theft, malware development, and activity inside compromised networks. Sophos found growing discussion across underground forums and marketplaces about large language models being used for multilingual lures, deepfake-enabled fraud, and other attack workflows, while ReliaQuest reported that AI has made attacks cheaper, faster to scale, easier to customize, and harder to detect without fundamentally changing core intrusion tradecraft. Proofpoint’s 2026 ransomware survey found **65%** of victim organizations believed AI increased attack effectiveness, with human interaction frequently enabling initial access through malicious links, attachments, and credential harvesting. Researchers said AI is now being applied to industrial-scale phishing, identity fabrication, phishing pages, web shells, credential harvesters, code padding to evade static analysis, and fake AI-branded downloads, while some criminals also worry automation could displace manual operators or degrade criminal product quality. Defenders were urged to reinforce core controls including **MFA**, passkeys, patching, behavioral detection, environment visibility, and defense-in-depth as AI-assisted attacks become more convincing and covert.
Aug 11, 2026
Security reporting and industry research indicate that **generative AI is becoming embedded in offensive cyber operations**, especially in phishing and other lower-skill attack workflows. Kaseya reported that AI-generated phishing became the default in 2025, citing widespread use of AI in phishing and BEC, higher click-through rates, and improved message quality that removes traditional warning signs such as poor grammar and repetitive templates. Bridewell's survey of UK critical national infrastructure organizations similarly found that **AI-related cyber risk** has become a top concern, with respondents linking it to more scalable phishing, BEC, and malware activity while also reporting broad exposure to cyber incidents and operational disruption. An SC Media commentary pushed the trend further, arguing that AI is also reducing the expertise required for more advanced intrusions by describing a reported campaign against Mexican government entities in which an attacker allegedly used multiple chatbots for planning and troubleshooting during a prolonged data theft operation. That account is presented as opinion rather than a formal incident disclosure, but it aligns with the broader pattern that **LLMs are lowering the barrier to entry for cybercrime** and making attacks harder to detect because defenders must increasingly assess intent and context rather than rely on legacy indicators alone.
Jun 29, 2026
An AI-orchestrated offensive framework called **CyberStrikeAI** has moved from a public GitHub release to apparent operational use by threat actors, highlighting how artificial intelligence is speeding up established attack techniques rather than replacing them. The framework reportedly combines more than 100 tools for reconnaissance, exploitation, and reporting under an orchestration layer that automates multi-step intrusion chains, and researchers said they observed at least 21 unique IP addresses running related infrastructure in early 2026. One reported incident linked the tool to a successful attack against **Fortinet FortiGate** appliances, reinforcing concerns that internet-facing edge devices such as firewalls and VPN systems remain attractive targets because they are often under-patched and lightly monitored. Broader reporting indicates AI is amplifying multiple attack categories at once, including social engineering, vulnerability exploitation, authentication attacks, and side-channel techniques, while also creating a growing attack surface around AI systems themselves. Security researchers and industry observers warn that AI-enabled phishing, deepfakes, automated vulnerability discovery, prompt injection, data poisoning, jailbreaking, model manipulation, API abuse, and malicious models are making attacks faster and more scalable. The trend underscores the need for organizations to verify exploitability, accelerate remediation of exposed assets, and continuously test defenses as offensive operations become more autonomous.
Jun 29, 2026