Loading story…
Threat researchers and industry reports say cybercriminals are increasingly using AI-powered tooling to improve phishing, social engineering, credential theft, malware development, and activity inside compromised networks. Sophos found growing discussion across underground forums and marketplaces about large language models being used for multilingual lures, deepfake-enabled fraud, and other attack workflows, while ReliaQuest reported that AI has made attacks cheaper, faster to scale, easier to customize, and harder to detect without fundamentally changing core intrusion tradecraft.
Proofpoint’s 2026 ransomware survey found 65% of victim organizations believed AI increased attack effectiveness, with human interaction frequently enabling initial access through malicious links, attachments, and credential harvesting. Researchers said AI is now being applied to industrial-scale phishing, identity fabrication, phishing pages, web shells, credential harvesters, code padding to evade static analysis, and fake AI-branded downloads, while some criminals also worry automation could displace manual operators or degrade criminal product quality. Defenders were urged to reinforce core controls including MFA, passkeys, patching, behavioral detection, environment visibility, and defense-in-depth as AI-assisted attacks become more convincing and covert.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On July 22, Proofpoint published its 2026 AI-Era Ransomware Report, stating that AI tooling has become part of the attacker playbook in ransomware operations. The report said 65% of surveyed organizations hit by ransomware believed AI increased the effectiveness of the attack.
ReliaQuest said that by mid-2025, underground AI use had expanded to include deepfake services, AI-assisted scripts, and a growing market for AI-enabled tools. It assessed that AI had moved closer to the core offensive workflow of cyber intrusions.
ReliaQuest reported that in 2024, threat actors primarily used AI to polish phishing emails, generate basic scripts, and support malicious tools such as FraudGPT. The company characterized this as an earlier stage before AI moved closer to core intrusion workflows.
Sophos reported a spike in cybercriminal forum discussions about AI following the launch of Claude Mythos Preview. The discussions reflected both interest in AI-enabled cybercrime and skepticism about how disruptive frontier models would be.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourceinfosecurity-magazine.com
Open sourceinfosecurity-magazine.com
Open sourcesophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and industry research indicate that **generative AI is becoming embedded in offensive cyber operations**, especially in phishing and other lower-skill attack workflows. Kaseya reported that AI-generated phishing became the default in 2025, citing widespread use of AI in phishing and BEC, higher click-through rates, and improved message quality that removes traditional warning signs such as poor grammar and repetitive templates. Bridewell's survey of UK critical national infrastructure organizations similarly found that **AI-related cyber risk** has become a top concern, with respondents linking it to more scalable phishing, BEC, and malware activity while also reporting broad exposure to cyber incidents and operational disruption. An SC Media commentary pushed the trend further, arguing that AI is also reducing the expertise required for more advanced intrusions by describing a reported campaign against Mexican government entities in which an attacker allegedly used multiple chatbots for planning and troubleshooting during a prolonged data theft operation. That account is presented as opinion rather than a formal incident disclosure, but it aligns with the broader pattern that **LLMs are lowering the barrier to entry for cybercrime** and making attacks harder to detect because defenders must increasingly assess intent and context rather than rely on legacy indicators alone.
Jun 29, 2026
Threat actors are increasingly using **AI to industrialize phishing**, generating high volumes of near-unique emails and rapidly iterating lures, links, and attachments in ways that degrade the effectiveness of signature-based and gateway-centric controls. Cofense-reported telemetry cited in industry coverage indicates enterprises saw **one malicious email on average every 19 seconds during 2025**, with campaigns often reusing underlying infrastructure even as message content continuously mutates. Phishing sites are also becoming more adaptive, tailoring content and payload delivery based on the victim’s device and environment (e.g., different outcomes for Windows, macOS, and mobile), while collecting detailed browser and system attributes to support customization and evasion. This shift is driving executive concern and shaping security investment priorities for 2026, with broader industry reporting highlighting **AI-enabled attacks**, fraud, and phishing as top risks and positioning **AI-enabled security** as a key countermeasure to keep pace with adversaries’ automation. Separately, an opinion-focused piece argues that AI changes the “build vs. buy” calculus for security teams by enabling more internal tool development and altering what types of security products deliver value; however, it does not provide incident-specific or phishing-specific intelligence. Overall, the most actionable signal across the sources is the operational reality of AI-driven phishing volume, adaptive delivery, and evasion—reinforcing the need to prioritize resilient detection and response capabilities over static indicators alone.
Jun 29, 2026
Cybercriminals are increasingly leveraging artificial intelligence and advanced social engineering techniques to conduct sophisticated phishing campaigns targeting both individuals and organizations. Recent reports highlight a surge in phishing attacks that utilize AI and machine learning to craft highly personalized and convincing lures, making detection more challenging for traditional security tools. Attackers are now able to scrape social media for personal data, generate emails in a target’s native language, and automate the creation of malicious content, all with minimal effort. One notable campaign tracked since February targets social media and marketing professionals by impersonating well-known brands such as Tesla, Red Bull, and Ferrari, enticing victims to upload resumes under the guise of job opportunities. These emails employ subtle psychological tactics, such as reducing urgency to build trust, and use multi-step processes to create an illusion of legitimacy. Another observed campaign used AI to obfuscate malicious payloads within SVG files, making them harder for security filters to detect. In this case, attackers sent phishing emails from compromised small business accounts, posing as file-sharing notifications, and used self-addressed email tactics to bypass basic detection heuristics. If recipients opened the attached file, they were redirected to credential-stealing websites. Microsoft researchers noted that the complexity and structure of the malicious code suggested it was generated by a large language model, rather than written by a human. The adoption of AI by threat actors is part of a broader trend, with both defenders and attackers racing to outpace each other in the use of transformative technologies. Security experts emphasize the importance of a layered defense, recommending strong passwords, multi-factor authentication, regular software updates, and ongoing user training to identify and report suspicious content. The rise of AI-driven phishing has increased the frequency and sophistication of attacks, with some security centers now detecting a malicious email every 42 seconds. Organizations are urged to remain vigilant, as even basic threat actors can now execute complex attacks with the help of AI tools. The evolving threat landscape underscores the need for proactive monitoring, rapid incident response, and continuous education to mitigate the risks posed by these advanced phishing campaigns. As attackers continue to refine their methods, defenders must adapt by leveraging AI for detection and response, and by fostering a security-aware culture among users. The convergence of AI and phishing represents a significant escalation in cyber risk, demanding heightened attention from both technical and non-technical stakeholders.
Jul 12, 2026