Are Hackers Using AI to Create Malware?

Quick answer: Yes. AI lowers the barrier to creating malware, writing convincing phishing, and automating attacks. Attackers don't need to be experts anymore—AI helps them code, craft, and scale. Defence must adapt to faster, more sophisticated, more personalised attacks.

What Attackers Use AI For

Malware creation and modification

AI helps attackers:

• Generate malware code from descriptions
• Modify existing malware to evade detection
• Create polymorphic malware (constantly changing)
• Debug and improve malicious code
• Bypass security controls faster

Example: "Write me code that encrypts all files in a directory with AES and sends the key to a remote server."

Commercial AI has guardrails. Jailbreaks exist. Underground AI models have no restrictions.

Phishing at scale

AI enables:

• Grammatically perfect phishing in any language
• Personalised content using scraped information
• Writing style mimicry
• Rapid generation of variations
• Automated A/B testing of campaigns

The "spelling errors reveal phishing" rule is dead.

Vulnerability discovery

AI can:

• Analyse code for vulnerabilities
• Suggest exploits for discovered flaws
• Automate fuzzing
• Identify attack paths

Attackers find and exploit weaknesses faster.

Social engineering enhancement

AI powers:

• Voice cloning for vishing
• Deepfake video for impersonation
• Realistic chatbots for pretexting
• Automated OSINT gathering

Human-level deception at machine scale.

What's Actually Happening (2026)

AI-assisted attacks are common

Most attacks now have some AI involvement—usually in content creation (phishing, lures) rather than pure technical exploitation.

Sophistication barrier has dropped

Attackers who couldn't code can now create functional malware. The pool of capable attackers has expanded.

Attack speed has increased

AI accelerates every phase: reconnaissance, payload creation, delivery, evasion. Defenders have less time.

Personalisation has increased

Attacks are more targeted because AI makes personalisation cheap.

Underground AI services exist

WormGPT, FraudGPT, and others—criminal AI services with no guardrails, sold as a service.

How to Defend Against AI-Powered Threats

Fight AI with AI

AI-enhanced detection:

• Machine learning-based email security
• Behavioural analysis (not just signatures)
• Anomaly detection across environments
• Adaptive threat intelligence

Traditional signature-based detection can't keep pace with AI-generated variants.

Assume compromise

Zero Trust principles:

• Verify every access request
• Limit blast radius
• Detect post-compromise activity
• Prepare for breach

If attacks are more sophisticated, assume some will succeed. Limit damage.

Focus on behaviour, not content

Detection evolution:

• What the malware does, not what it looks like
• User behaviour anomalies
• Network traffic patterns
• Process behaviour analysis

AI-generated malware can change appearance. Behaviour is harder to hide.

Strengthen authentication

Phishing resistance:

• Passkeys and FIDO2
• Phishing-resistant MFA
• Conditional Access
• Zero standing privilege

If phishing is more convincing, make stolen credentials less useful.

Update training

Modern awareness:

• AI-quality attacks are the norm
• Visual verification is unreliable (deepfakes)
• Verification processes essential
• Healthy scepticism

"Check for spelling errors" is obsolete advice.

Increase verification

Process controls:

• Out-of-band verification for sensitive actions
• Multi-person authorisation
• Callback procedures
• "Trust but verify" culture

When AI makes deception easy, process stops attacks that technology misses.

What We're Doing

We're adapting our services for the AI threat landscape:

Technology:

• AI-powered email security
• Behavioural EDR/MDR
• Anomaly-based detection

Process:

• Updated security awareness training
• Verification procedure guidance
• Incident response for AI-enabled attacks

Intelligence:

• Monitoring AI threat evolution
• Updating defences as threats change
• Sharing relevant intelligence with clients

The threat landscape is evolving fast. So are we.

---

about modern threat protection.

---