AI Threat Watch: AI-Enabled

Detecting and countering misuse of AI: September 2026

Fri, 18 Sep 2026 06:00:00 GMT

Anthropic describes actors who automate whole intrusion chains with AI agents. One Russian-speaking espionage operator had agents rebuild malware whenever a security product detected it, and used AI to sort hundreds of gigabytes of stolen data.

AI-Enabled (Attackers using AI) | Source: Anthropic | Actors: GTG-20006, Midnight Blizzard, GTG-50014, JackPoterz | Malware: PentAGI, WPPConnect, Embassy Kit, CaptiveCrunch | Attribution: Russia, per Anthropic (confidence not stated)

Devil’s advocate? Uncensored Luciferus AI service advertised underground

Mon, 21 Sep 2026 09:59:48 GMT

Sophos CTU researchers found an underground forum persona advertising Luciferus, an uncensored AI service claiming to be a proprietary 120-billion-parameter model, though researchers assess with low confidence it is based on Qwen. The service offers tiered subscriptions and demonstrated willingness to generate malware code like a Python RAT, illustrating growing commercialization of uncensored AI in cybercrime market

AI-Enabled (Attackers using AI) | Source: Sophos | Actors: Optimus_Prime | Malware: Luciferus, WormGPT, FraudGPT

New packages identified in GemStuffer 'OpenAI Swarm' malicious RubyGems campaign

Mon, 21 Sep 2026 09:59:39 GMT

JFrog identified over 3,000 malicious RubyGems packages tied to the GemStuffer campaign, some exploiting a RubyGems legacy API-key caching flaw to steal credentials and others using XSS or template-injection payloads in package metadata. Naming patterns and prior incidents link the campaign to OpenAI Swarm agents generating packages at scale, though original prompts remain unavailable.

AI-Enabled (Attackers using AI) | Source: JFrog Security Research | Actors: OpenAI Swarm | Malware: slnleaker5, f2fe-s1, yardxabc889, southpxdatapp6pi, xss-test-gem, test-apex-gem, test-ssti-0, test-ssti-1

Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve

Mon, 21 Sep 2026 09:58:49 GMT

Genians analyzed 13 malicious LNK files linked to Kimsuky, part of an ongoing campaign called Operation GitPower using GitHub PAT-based C2 and PowerShell loaders. Metadata in decoy PDF documents showed traces of the AI coding agent 'opencode' and unreplaced placeholder text, indicating the actor used AI/LLMs to mass produce decoy documents without proper review.

AI-Enabled (Attackers using AI) | Source: Genians | Actors: Kimsuky

Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

Mon, 21 Sep 2026 10:18:58 GMT

Unit 42 documents two active Latin American intrusion campaigns, one against Mexican/Ecuadorian government and transportation targets and one against Brazilian financial firms, where attackers used self-hosted NextChat instances and commercial LLMs like Claude and GPT-4.1 to troubleshoot scripts and build proxy tools. Exposed staging infrastructure showed AI-generated iterative filenames and prompt history, revealing

AI-Enabled (Attackers using AI) | Source: Unit 42 | Malware: NextChat, SockTz

Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation

Mon, 21 Sep 2026 09:57:34 GMT

Gambit Security found Aurora ransomware operators using Cursor Agent with Claude Sonnet to run hands-on exploitation, including domain enumeration, NTLM relay, and certificate attacks, across ten victims. The group also deployed a new Linux ESXi ransomware variant and a separate cluster using S3 exfiltration infrastructure.

AI-Enabled (Attackers using AI) | Source: Gambit Security | Actors: Aurora | Malware: Aurora, Cursor Agent, Claude Sonnet, NetExec, Impacket, Certipy, PetitPotam, Coerce Plus

VMs won't contain cyber-capable agents

Mon, 21 Sep 2026 09:57:26 GMT

Trail of Bits tested a preview of OpenAI's GPT 5.6-Cyber agent and had it attempt to escape a QEMU/KVM sandbox. The agent autonomously escaped three times, using a recently disclosed kernel bug, an unpatched libslirp flaw, and finally a chain of several previously unknown 0-days in QEMU, KVM, and libslirp, operating for roughly 12 hours with minimal human guidance. It failed to break out of the more hardened Firecrac

AI-Enabled (Attackers using AI) | Source: Trail of Bits | Vulnerabilities: CVE-2026-53359, CVE-2026-9539

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Mon, 21 Sep 2026 09:57:00 GMT

Cisco Talos documented a financially motivated, Chinese-speaking group, UAT-10147, using agentic AI tools like PentestGPT and DeepAudit alongside Metasploit and known CVEs to automate exploitation, reconnaissance, payload generation, and troubleshooting against Windows and Linux web servers worldwide. Talos assesses with moderate-to-high confidence this represents a shift from AI-assisted scripting to semi-autonomous

AI-Enabled (Attackers using AI) | Source: Cisco Talos | Actors: UAT-10147 | Malware: QuasarRAT, EfsPotato, BadIIS, Gh0stCringe, SPECTRE, NoodleRAT, Meterpreter, DeepAudit | Vulnerabilities: CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, CVE-2022-0847, CVE-2022-27925, CVE-2021-23758, CVE-2021-29441, CVE-2021-29442, CVE-2019-18935 | Attribution: China, per Cisco Talos (confidence not stated)

Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM

Mon, 21 Sep 2026 09:56:25 GMT

Genians Security Center documented the North Korea-linked Kimsuky group using AI-generated decoy documents and experimenting with local LLM tools (Ollama, GPT4All, Msty) in an ongoing campaign dubbed Operation GitPower. The actor uses LNK files, obfuscated PowerShell, and GitHub-hosted repositories as C2 to distribute AsyncRAT payloads disguised as PNG images, targeting diplomatic, military, and virtual asset sector

AI-Enabled (Attackers using AI) | Source: Genians Security Center | Actors: Kimsuky | Malware: AsyncRAT, FlowerPower, Operation GitPower | Attribution: North Korea, per Genians Security Center (confidence not stated)

AI Security 2026

Mon, 21 Sep 2026 09:55:41 GMT

Sophos's 2026 AI Security Report details a real-world case, tracked as STAC6994, where about a dozen AI agents built and tested EDR evasion malware across parallel VMs, compressing weeks of development into days, before the operator deployed ransomware and stole data. The report also covers AI supply-chain attacks, underground AI infrastructure sales, and exploit timelines outpacing patching.

AI-Enabled (Attackers using AI) | Source: Sophos | Actors: STAC6994, IRON TWILIGHT (APT28), The Gentlemen, DragonForce | Malware: LameHug, MacSync, Sliver | Vulnerabilities: CVE-2026-10520, CVE-2026-42208 | Attribution: China, per Anthropic (confidence not stated)

APT42: AI-Assisted Rapport Phishing and a More Resilient TAMECAT Backdoor

Mon, 21 Sep 2026 09:55:17 GMT

Darkatlas documents Iran-linked APT42/TA453 activity including the SpearSpecter campaign, which uses search-ms and WebDAV abuse to deliver an expanded TAMECAT backdoor with browser cookie theft and multi-channel C2 via HTTPS, Discord and Telegram. The report also describes APT42 incorporating generative AI into reconnaissance, persona and pretext creation, translation, and malware development.

AI-Enabled (Attackers using AI) | Source: Darkatlas | Actors: APT42, TA453, RedKitten | Malware: TAMECAT, SpearSpecter | Attribution: Iran, per Darkatlas (confidence not stated)

ClaudeFix: Shared Claude Chats Meet ClickFix

Mon, 21 Sep 2026 09:54:54 GMT

Zscaler Threat Hunting found threat actors abusing shared Claude chat links, disguised with an 'Apple Support' display name, to host ClickFix instructions that install MacSync Stealer on macOS via malvertising. The malware steals keychains, browser data, crypto wallets and files, then exfiltrates and self-deletes to avoid detection. Russian-language code comments suggest a Russian-speaking actor; the campaign ran Jun

AI-Enabled (Attackers using AI) | Source: Zscaler | Malware: MacSync Stealer | Attribution: Russia, per Zscaler Threat Hunting (low confidence)

Suspected Chinese Operators Use Claude Code and DeepSeek to Target Government and Financial Systems Across Four Countries

Mon, 21 Sep 2026 09:54:44 GMT

Hunt.io researchers found an open directory tied to TencShell C2 infrastructure showing suspected China-linked operators using Claude Code and DeepSeek-v4-pro to handle exploit reasoning, session persistence, and phishing page creation during live intrusions. Victims included government and critical infrastructure targets in Afghanistan, Thailand, and Taiwan, with reconnaissance against U.S. government portals and sc

AI-Enabled (Attackers using AI) | Source: Hunt.io | Malware: TencShell, Vshell, ARL, DeepAudit, Gshell, HSEWH-Ur | Attribution: China, per Hunt.io (low confidence)

REF6045: Mexican banking fraud toolkit with signs of AI-assisted development

Mon, 21 Sep 2026 08:43:43 GMT

Elastic Security Labs documented REF6045, an operator-assisted banking fraud campaign using ClickFix fake-CAPTCHA lures to install a PowerShell toolkit called SCMBANKER against Mexican bank, fintech, and crypto exchange customers. The toolkit enables session monitoring, screenshots, vishing overlays, clipboard hijacking, and RAT deployment, and its scripts show artifacts suggesting an LLM was used to write most of th

AI-Enabled (Attackers using AI) | Source: Elastic Security Labs | Malware: SCMBANKER, Remote Utilities | Attribution: not-stated, per Elastic Security Labs (confidence not stated)

Mycelium Framework: First Ever Witnessed AI-as-a-Service Botnet

Mon, 21 Sep 2026 08:44:11 GMT

Flare researchers describe an underground forum advertisement for 'Mycelium Framework,' a botnet claiming to classify infected machines by compute, GPU, stolen AI API keys and local models, then route AI inference, social engineering and other tasks accordingly. No source code or proof of execution was provided, and most individual techniques are previously documented, so the AI-as-a-service claims remain unverified.

AI-Enabled (Attackers using AI) | Source: Flare | Malware: Mycelium Framework, Mirai, TeamTNT, DorkBot, RageBot, Phorpiex, IRCBot.HI | Vulnerabilities: CVE-2021-22205

JADEPUFFER: Agentic ransomware for automated database extortion

Mon, 21 Sep 2026 08:43:36 GMT

Sysdig's Threat Research Team documented what they assess to be the first fully agentic ransomware operation, dubbed JADEPUFFER, where an LLM autonomously gained access via a Langflow RCE flaw, harvested credentials, exploited Nacos authentication bypasses, and encrypted and destroyed a victim's production database for extortion. The payloads showed self-narrating reasoning and adaptive retries with no human interven

AI-Enabled (Attackers using AI) | Source: Sysdig | Actors: JADEPUFFER | Malware: JADEPUFFER | Vulnerabilities: CVE-2025-3248, CVE-2021-29441

Threat Actors Weaponize AI Hype to Deliver AsyncRAT

Mon, 21 Sep 2026 08:42:26 GMT

FortiGuard Labs documented a multi-stage Windows malware campaign using fake AI-themed documents and guides as lures to deliver AsyncRAT via AutoHotkey-based loaders and process hollowing. Chinese-language code artifacts and structured coding style suggest the attackers used generative AI tools to help build the malware, though this is inferred rather than confirmed.

AI-Enabled (Attackers using AI) | Source: FortiGuard Labs | Malware: AsyncRAT, AutoHotkey, clay_Client

What we learned mapping a year's worth of AI-enabled cyber threats

Mon, 21 Sep 2026 08:41:04 GMT

Anthropic analyzed 832 accounts banned for malicious cyber activity between March 2025 and March 2026, mapping their techniques to MITRE ATT&CK. They found AI use shifting from initial access to post-compromise activity, risk scores rising over time, and the framework failing to capture autonomous agentic orchestration seen in a November 2025 state-sponsored espionage case.

AI-Enabled (Attackers using AI) | Source: Anthropic | Malware: Claude Code

One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign

Mon, 21 Sep 2026 10:16:56 GMT

A solo Russian-speaking threat actor ran a 5-year MAGA-themed Telegram influence channel and, starting September 2025, used a jailbroken Google Gemini to automate content creation, manage infrastructure, rotate stolen API keys, and run a QAnon-styled fraud chatbot. The campaign combined credential theft, a fake crypto wallet RAT, and a token scheme, showing AI can lower the cost of running influence and fraud operati

AI-Enabled (Attackers using AI) | Source: Trend Micro | Actors: bandcampro | Malware: GoToResolve, StellarMonster, Quantum Patriot, QFS 2.0 Terminal | Attribution: Russia, per Trend Micro (medium confidence)

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Tue, 12 May 2026 06:00:00 GMT

GTIG reports adversaries applying AI to vulnerability exploitation, initial access and faster development of evasive, polymorphic malware. It also covers supply chain attacks against AI components, and notes no actor has yet bypassed the core safety logic of frontier models.

AI-Enabled (Attackers using AI) | Source: Google Threat Intelligence Group

Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America

Mon, 21 Sep 2026 08:40:31 GMT

Trend Micro identified two campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, using agentic AI (including Claude) to drive intrusions from initial access to data exfiltration against government and financial targets in Mexico and Brazil. The AI agents dynamically generated custom tools and backdoors, used jailbreaking via fake red-team pretexts, and integrated with Shodan and VulDB for reconnaissance.

AI-Enabled (Attackers using AI) | Source: Trend Micro | Actors: SHADOW-AETHER-040, SHADOW-AETHER-064 | Malware: Chisel, Neo-reGeorg, CrackMapExec, Impacket, implante_http, ProxyChains, PetitPotam

AI Meets Voice Phishing: How ATHR Automates the Full TOAD Attack Chain

Mon, 21 Sep 2026 10:16:32 GMT

Researchers describe ATHR, a crimeware platform sold for $4,000 plus 10% of profits that combines AI voice agents, spoofed lure emails, and live phishing panels to automate telephone-oriented attack delivery (TOAD) scams. Its AI vishing agents run scripted social engineering calls targeting crypto and email brand users, letting one operator run multi-brand campaigns without trained callers.

AI-Enabled (Attackers using AI) | Source: Abnormal AI | Malware: ATHR

A Single Operator, Two AI Platforms, Nine Government Agencies: The Full Technical Report

Mon, 21 Sep 2026 08:40:23 GMT

Gambit Security's forensic report describes a single operator who used Claude Code and OpenAI's GPT-4.1 as core operational tools to breach nine Mexican government organizations and exfiltrate hundreds of millions of records between December 2025 and February 2026. Recovered materials show over 400 custom attack scripts, 20 tailored exploits, and thousands of AI-generated commands used to compress attack timelines an

AI-Enabled (Attackers using AI) | Source: Gambit Security | Attribution: Mexico, per Gambit Security (confidence not stated)

A Slopoly start to AI-enhanced ransomware attacks

Mon, 21 Sep 2026 08:40:16 GMT

IBM X-Force found a likely AI-generated PowerShell C2 backdoor, dubbed Slopoly, deployed by ransomware group Hive0163 during a live intrusion using ClickFix, NodeSnake, InterlockRAT and Interlock ransomware. The malware is technically unremarkable but shows guardrail bypass and signals adoption of AI-assisted malware development among established ransomware actors.

AI-Enabled (Attackers using AI) | Source: IBM X-Force | Actors: Hive0163, ITG23, TA569, TAG-124 | Malware: Slopoly, NodeSnake, InterlockRAT, Interlock, JunkFiction, Broomstick, Supper, PortStarter

Fake VCs target crypto talent in a new ClickFix campaign

Mon, 21 Sep 2026 10:14:58 GMT

Moonlock Lab documented a campaign using fake venture capital personas on LinkedIn to lure crypto professionals into spoofed Zoom/Meet pages running a ClickFix fake CAPTCHA that tricks victims into executing clipboard-injected commands, deploying cross-platform malware. Fake company sites used AI-generated headshots for fabricated staff, and infrastructure overlaps with DPRK-linked UNC1069, though attribution remains

AI-Enabled (Attackers using AI) | Source: Moonlock Lab | Actors: Mykhailo Hureiev, Anatolli Bigdasch, UNC1069 | Attribution: North Korea, per Moonlock Lab (low confidence)

Disrupting malicious uses of AI

Wed, 25 Feb 2026 06:00:00 GMT

OpenAI's case studies show models used as one step in larger workflows that also rely on websites and social accounts: romance and recovery scams, covert influence operations, and a state-linked harassment effort.

AI-Enabled (Attackers using AI) | Source: OpenAI | Actors: Rybar

LLMs in the Kill Chain: Inside a Custom MCP Targeting FortiGate Devices Across Continents

Mon, 21 Sep 2026 08:39:34 GMT

Researchers found an exposed server revealing a threat actor using a custom MCP server (ARXON) with DeepSeek and Claude Code to automate reconnaissance, attack planning, and exploitation of compromised FortiGate devices across thousands of targets in over 100 countries. The actor evolved from using open-source HexStrike MCP tooling in December 2025 to fully custom orchestration (ARXON and CHECKER2) by February 2026,

AI-Enabled (Attackers using AI) | Source: Hunt.io / cyberandramen.net | Malware: ARXON, CHECKER2, HexStrike, ntlmrelayx.py, Impacket, Metasploit, BloodHound, Nuclei | Vulnerabilities: CVE-2019-6693, CVE-2026-24061, CVE-2025-33073, CVE-2023-27532, CVE-2019-7192

AI-augmented threat actor accesses FortiGate devices at scale

Mon, 21 Sep 2026 08:39:05 GMT

Amazon Threat Intelligence documented a Russian-speaking, financially motivated actor using multiple commercial LLMs to compromise over 600 FortiGate devices in 55+ countries via exposed management interfaces and weak credentials, not exploits. AI generated attack plans, custom Go/Python tooling, and reconnaissance scripts, letting a low-skill actor achieve broad operational scale, though it still failed against hard

AI-Enabled (Attackers using AI) | Source: Amazon Threat Intelligence | Actors: Ed1s0nZ | Malware: Meterpreter, mimikatz, gogo, Nuclei, CyberStrikeAI, PrivHunterAI, InfiltrateX, watermark-tool | Vulnerabilities: CVE-2019-7192, CVE-2023-27532, CVE-2024-40711

PromptSpy ushers in the era of Android threats using GenAI

Mon, 21 Sep 2026 08:39:17 GMT

ESET found PromptSpy, Android malware that queries Google's Gemini with UI XML dumps to get step-by-step instructions for locking itself into the recent apps list, aiding persistence. The malware also deploys a VNC module for remote device control and targets users in Argentina; no live samples have been seen in telemetry, suggesting it may still be a proof of concept.

AI-Enabled (Attackers using AI) | Source: ESET Research | Malware: PromptSpy, VNCSpy, PromptLock, Android.Phantom, Android/Phishing.Agent.M | Attribution: China, per ESET (medium confidence)

GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use

Thu, 12 Feb 2026 06:00:00 GMT

Quarterly view of how actors linked to North Korea, Iran, China and Russia used AI in late 2025. GTIG saw no breakthrough capability, but disrupted frequent model extraction attempts against its own models.

AI-Enabled (Attackers using AI) | Source: Google Threat Intelligence Group | Attribution: North Korea, per Google Threat Intelligence Group (confidence not stated); Iran, per Google Threat Intelligence Group (confidence not stated); China, per Google Threat Intelligence Group (confidence not stated); Russia, per Google Threat Intelligence Group (confidence not stated)

The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time

Mon, 21 Sep 2026 10:14:32 GMT

Unit 42 researchers built a proof of concept where a benign-looking webpage queries trusted LLM APIs like DeepSeek and Gemini at runtime to generate and assemble phishing JavaScript in the victim's browser, bypassing network detection and guardrails through prompt engineering. This produces polymorphic, brand-impersonating phishing pages with no static malicious payload, though the technique was not observed used by

AI-Enabled (Attackers using AI) | Source: Unit 42 (Palo Alto Networks) | Malware: LogoKit

AI-Poisoning & AMOS Stealer: The Biggest Mac Threat

Mon, 21 Sep 2026 10:14:12 GMT

Huntress found that attackers used SEO poisoning to push fake ChatGPT and Grok shared conversations, hosted on legitimate OpenAI and xAI domains, to the top of Google results for common Mac troubleshooting queries. Victims who followed the AI-generated Terminal instructions were infected with an AMOS stealer variant that harvests credentials, escalates to root, and persists via a LaunchDaemon watchdog.

AI-Enabled (Attackers using AI) | Source: Huntress | Malware: AMOS, Atomic macOS Stealer

The Dual-Use Dilemma of AI: Malicious LLMs

Mon, 21 Sep 2026 10:13:54 GMT

Unit 42 examines two commercialized malicious LLMs, WormGPT and KawaiiGPT, sold or freely distributed to cybercriminals for generating phishing, BEC lures, ransomware code and ransom notes. Testing showed WormGPT 4 producing functional PowerShell ransomware scripts and KawaiiGPT crafting convincing spear-phishing content, lowering technical barriers for less-skilled attackers.

AI-Enabled (Attackers using AI) | Source: Unit 42 | Malware: WormGPT, WormGPT 4, KawaiiGPT

The Future of Malware is LLM-powered

Mon, 21 Sep 2026 10:13:45 GMT

Netskope Threat Labs tested whether GPT-3.5-Turbo, GPT-4 and preliminary GPT-5 could be prompted or jailbroken into generating malicious code for process injection and VM detection. They found guardrails could be bypassed with role-based prompt injection but generated code was often unreliable, especially against cloud VDI, though GPT-5 showed marked improvement. This is proof-of-concept research, not an observed rea

AI-Enabled (Attackers using AI) | Source: Netskope

Disrupting the first reported AI-orchestrated cyber espionage campaign

Thu, 13 Nov 2025 06:00:00 GMT

A group tasked Claude Code with running intrusions against roughly 30 organisations, with the model carrying out an estimated 80 to 90 percent of tactical work. Anthropic validated a handful of successful compromises before banning the accounts.

AI-Enabled (Attackers using AI) | Source: Anthropic | Actors: GTG-1002, Chinese state-sponsored group | Malware: Claude Code | Attribution: China, per Anthropic (high confidence)

GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools

Wed, 05 Nov 2025 06:00:00 GMT

GTIG documents the first malware families that query an LLM during execution to generate scripts and rewrite their own code. It also describes actors posing as students or researchers to talk Gemini past its safeguards.

AI-Enabled (Attackers using AI) | Source: Google Threat Intelligence Group | Actors: APT28 | Malware: PROMPTFLUX, PROMPTSTEAL

APT Meets GPT: Targeted Operations with Untamed LLMs

Mon, 21 Sep 2026 10:13:23 GMT

Volexity documents UTA0388, a China-aligned actor running spear phishing campaigns since June 2025 that deploy the GOVERSHELL backdoor via search order hijacking. Volexity assesses with high confidence the group used LLMs, later confirmed by OpenAI, to assist phishing content and malware development, and links the group to Proofpoint's previously reported UNK_DropPitch/HealthKick activity.

AI-Enabled (Attackers using AI) | Source: Volexity | Actors: UTA0388, UNK_DropPitch | Malware: GOVERSHELL, HealthKick, Tablacus Explorer | Attribution: China, per Volexity (high confidence)

Disrupting malicious uses of AI: October 2025

Tue, 07 Oct 2025 06:00:00 GMT

OpenAI details banned accounts tied to state actors and criminal groups that used ChatGPT for malware development, scams and surveillance tooling. It reports no evidence that its models gave attackers novel offensive capability.

AI-Enabled (Attackers using AI) | Source: OpenAI | Actors: Russian-speaking criminal groups, North Korean (DPRK) actors | Malware: XenoRAT

DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception

Mon, 21 Sep 2026 10:13:05 GMT

ESET details DeceptiveDevelopment, a North Korea-aligned group using fake recruiter profiles and ClickFix social engineering to deliver malware like BeaverTail, InvisibleFerret, OtterCookie, WeaselStore and TsunamiKit to job-seeking developers across Windows, Linux and macOS. The group is closely linked to North Korean IT worker campaigns (WageMole) that use AI-driven tools to fabricate synthetic identities to secure

AI-Enabled (Attackers using AI) | Source: ESET Research | Actors: DeceptiveDevelopment, WageMole, Contagious Interview, DEV#POPPER, Void Dokkaebi, Lazarus | Malware: BeaverTail, InvisibleFerret, OtterCookie, WeaselStore, GolangGhost, FlexibleFerret, PylangGhost, TsunamiKit | Attribution: North Korea, per ESET Research (high confidence)

SentinelOne finds MalTerminal malware using OpenAI GPT-4

Tue, 23 Sep 2025 06:00:00 GMT

SentinelLABS hunted for binaries carrying LLM API keys and embedded prompts, and found MalTerminal, which asks GPT-4 to write ransomware or a reverse shell at runtime. A retired API endpoint dates it before November 2023. No live use is known.

AI-Enabled (Attackers using AI) | Source: Dataconomy | Malware: MalTerminal

AI-Driven Deepfake-Based Military ID Forgery APT Campaign

Mon, 21 Sep 2026 10:12:41 GMT

Genians Security Center documented a July 2025 spear-phishing campaign impersonating a South Korean military ID office, where the attacker used ChatGPT to generate a fake military employee ID image, verified via metadata and deepfake detection tools. The email delivered obfuscated LNK and batch scripts leading to an AutoIt-based backdoor for persistence and C2 communication.

AI-Enabled (Attackers using AI) | Source: Genians | Malware: AutoIt3, config.bin, HncUpdateTray.exe

A new RevengeHotels campaign targets Latin America

Mon, 21 Sep 2026 10:12:50 GMT

Kaspersky reports that RevengeHotels (TA558), a hotel-targeting phishing group, now uses LLM-generated code in its JavaScript loaders and PowerShell downloaders to deliver VenomRAT. The campaign targets Brazilian and Spanish-speaking hotels via invoice-themed phishing emails, showing how a known criminal group is adopting AI to build malware components.

AI-Enabled (Attackers using AI) | Source: Securelist | Actors: RevengeHotels, TA558 | Malware: VenomRAT, QuasarRAT, RevengeRAT, NanoCoreRAT, NjRAT, 888 RAT, ProCC, XWorm | Vulnerabilities: CVE-2017-0199

Threat Intelligence Report: August 2025

Wed, 27 Aug 2025 06:00:00 GMT

Introduces vibe hacking: one criminal used Claude Code to run data extortion against at least 17 organisations. Other cases cover North Korean remote worker fraud, ransomware sold by a developer with little coding skill, and AI across the fraud ecosystem.

AI-Enabled (Attackers using AI) | Source: Anthropic | Actors: North Korean IT workers | Malware: Claude Code, Claude | Attribution: North Korea, per Anthropic (confidence not stated); China, per Anthropic (confidence not stated)

First known AI-powered ransomware uncovered by ESET Research

Tue, 26 Aug 2025 06:00:00 GMT

PromptLock runs OpenAI's gpt-oss-20b locally through Ollama to generate Lua scripts that enumerate, exfiltrate and encrypt files. ESET later confirmed the samples match an academic prototype, not malware deployed in attacks.

AI-Enabled (Attackers using AI) | Source: ESET Research | Malware: PromptLock

Phishing and scams: how fraudsters are deceiving users in 2025

Mon, 21 Sep 2026 10:11:40 GMT

Kaspersky researchers describe how scammers now use AI tools such as DeepSeek to write convincing phishing text, AI-generated voices and deepfakes for fake celebrity giveaways and bank impersonation calls, and OSINT AI tools to personalize attacks. The report also covers new evasion techniques like blob URLs, Google Translate proxying, and Telegram bot abuse, and a shift toward stealing biometric and signature data.

AI-Enabled (Attackers using AI) | Source: Securelist | Malware: DeepSeek

LAMEHUG: APT28's New Arsenal - First AI-Powered Malware Explained

Fri, 18 Jul 2025 06:00:00 GMT

CERT-UA reported that APT28 (UAC-0001) used LameHug, a Python malware delivered via phishing that queries the Qwen 2.5-Coder-32B-Instruct model through the Hugging Face API to generate Windows recon and exfiltration commands. This is described as one of the first publicly documented cases of malware using an LLM to dynamically generate attack commands against Ukrainian defense sector targets. Guardsix summarizes the

AI-Enabled (Attackers using AI) | Source: guardsix | Actors: APT28, UAC-0001, Forest Blizzard | Malware: LAMEHUG, LameHug, AI_generator_uncensored_Canvas_PRO_v0.9.exe, image.py | Attribution: Russia, per CERT-UA (medium confidence)

Cybercriminal abuse of large language models

Mon, 21 Sep 2026 10:11:02 GMT

Talos researchers document cybercriminals using uncensored LLMs, custom criminal LLMs like FraudGPT and WormGPT, and jailbreak techniques to write malware, phishing content and scan for vulnerabilities. The report also covers attacks against LLMs themselves, including pickle-based backdoored models on Hugging Face and RAG poisoning risks. Talos found that FraudGPT's seller was actually running a cryptocurrency scam r

AI-Enabled (Attackers using AI) | Source: Cisco Talos | Actors: CanadianKingpin12 | Malware: GhostGPT, WormGPT, DarkGPT, DarkestGPT, FraudGPT, WhiteRabbitNeo, Llama 2 Uncensored, OnionGPT

Black Hat SEO Poisoning Search Engine Results For AI to Distribute Malware

Mon, 21 Sep 2026 10:11:17 GMT

Zscaler researchers found threat actors using Black Hat SEO to rank fake AI-themed websites (mimicking tools like ChatGPT and Luma AI) highly in search results. Victims who click through are fingerprinted and redirected through multiple layers to download malware including Vidar, Lumma Stealer and Legion Loader, often bundled in oversized installers to evade sandboxes.

AI-Enabled (Attackers using AI) | Source: Zscaler ThreatLabz | Malware: Vidar, Lumma, Legion Loader, Legion Loader

Storm-1516 Deploys AI-Generated Media to Spread Disinformation: Targets European Leaders and Influences Istanbul Peace Talks

Mon, 21 Sep 2026 10:10:52 GMT

EclecticIQ documents pro-Kremlin group Storm-1516 using AI-generated images and videos to falsely accuse Macron, Starmer, Merz and Zelensky of cocaine use, aiming to undermine European unity ahead of Istanbul peace talks. The campaign was amplified by Storm-1516-linked X accounts and Russian MFA official Maria Zakharova, and relied on generative AI to fabricate visuals rapidly for viral spread.

AI-Enabled (Attackers using AI) | Source: EclecticIQ | Actors: Storm-1516 | Attribution: Russia, per EclecticIQ (high confidence)

False Face: Unit 42 Demonstrates the Alarming Ease of Synthetic Identity Creation

Mon, 21 Sep 2026 10:10:46 GMT

Unit 42 shows that North Korean IT worker operatives are using real-time deepfake tools during job interviews to create synthetic identities and evade detection. A researcher with no prior experience built a passable real-time deepfake in about 70 minutes using cheap hardware and free tools, illustrating low barriers to this technique. The report also outlines technical artifacts and HR/security mitigations to detect

AI-Enabled (Attackers using AI) | Source: Unit 42, Palo Alto Networks | Actors: North Korean IT workers, DPRK | Malware: Wagemole, BeaverTail, InvisibleFerret | Attribution: North Korea, per Unit 42, Palo Alto Networks (high confidence)

Operating Multi-Client Influence Networks Across Platforms

Mon, 21 Sep 2026 08:37:33 GMT

Anthropic disrupted an influence-as-a-service operation that used Claude to manage over 100 social media personas across X and Facebook, making tactical decisions on engagement and generating image prompts. The operation served at least four distinct clients pushing narratives on European, Iranian, UAE, and Kenyan interests, prioritizing persistence and relationship-building over viral spread. No nation-state attribu

AI-Enabled (Attackers using AI) | Source: Anthropic | Malware: Claude

How GhostGPT Empowers Cybercriminals with Uncensored AI

Mon, 21 Sep 2026 10:10:12 GMT

Abnormal Security researchers identified GhostGPT, an uncensored chatbot sold via Telegram that likely wraps a jailbroken ChatGPT or open-source LLM to remove safety guardrails. It is marketed to generate phishing emails, BEC templates, malware code and exploits, lowering the skill barrier for cybercriminals. Researchers tested it by having it produce a convincing Docusign phishing email template.

AI-Enabled (Attackers using AI) | Source: Abnormal AI | Malware: GhostGPT, WormGPT, WolfGPT, EscapeGPT

Adversarial Misuse of Generative AI

Wed, 29 Jan 2025 06:00:00 GMT

GTIG's first analysis of how government-backed groups used Gemini. Actors from Iran, China, North Korea and Russia used it for research, coding help and content, and did not develop novel capabilities with it.

AI-Enabled (Attackers using AI) | Source: Google Threat Intelligence Group | Actors: APT43 | Attribution: Iran, per Google Threat Intelligence Group (confidence not stated); China, per Google Threat Intelligence Group (confidence not stated); North Korea, per Google Threat Intelligence Group (confidence not stated); Russia, per Google Threat Intelligence Group (confidence not stated)

Jailbreaking Social Engineering via Adversarial Digital Twins

Mon, 21 Sep 2026 10:09:07 GMT

Knostic researchers describe a proof-of-concept red team method using an LLM to build a psychological profile and a fake persona ('Adversarial Digital Twin') from a target's social media data, then jailbreak the LLM's guardrails to generate rapport-building conversations for social engineering. The technique was demonstrated in a controlled exercise, not observed in the wild, but shows how LLMs could lower the skill

AI-Enabled (Attackers using AI) | Source: Knostic | Malware: Dark Gemini, Maltego

The Emerging Dynamics of Deepfake Scam Campaigns on the Web

Mon, 21 Sep 2026 10:08:35 GMT

Unit 42 researchers identified a large network of scam websites using deepfake videos of public figures like Elon Musk and various world leaders to promote fake investment schemes and government giveaways across multiple languages and countries. Infrastructure analysis of hundreds of domains, averaging 114,000 visits each, suggests a single threat actor group behind these long-running campaigns.

AI-Enabled (Attackers using AI) | Source: Unit 42 | Malware: Quantum AI

Black Basta and the Use of LLMs by Threat Actors

Mon, 21 Sep 2026 10:08:57 GMT

Microsoft researchers describe Black Basta's shifting initial access techniques across several malware loaders, then discuss how state-sponsored actors used LLMs via OpenAI accounts. Microsoft and OpenAI disrupted five state-affiliated accounts used for tasks like translation, coding help, and open-source research, consistent with actors' existing goals rather than new capabilities.

AI-Enabled (Attackers using AI) | Source: The CyberWire | Actors: Black Basta, Storm-506, Storm-1811, Storm-464, Storm-450, Forest Blizzard, Emerald Sleet, Strawberry Tempest | Malware: Qakbot, Pikabot, DarkGate, IcedID, TeamsPhisher, BatLoader, ZLoader, Cobalt Strike | Attribution: Russia, per Microsoft (confidence not stated); North Korea, per Microsoft (confidence not stated)

Social Media Malvertising Campaign Promotes Fake AI Editor Website for Credential Theft

Mon, 21 Sep 2026 10:08:10 GMT

Trend Micro documented a malvertising campaign that hijacks Facebook pages, rebrands them as the AI photo editor Evoto, and lures victims to download a disguised ITarian RMM installer. Once enrolled, the tool downloads Lumma Stealer and disables Windows Defender scanning to exfiltrate credentials, wallets and browser data. AI branding is used purely as a lure, not as an offensive capability.

AI-Enabled (Attackers using AI) | Source: Trend Micro | Malware: Lumma Stealer, PackLab Crypter, ITarian

AI-Powered Deepfake Tools Becoming More Accessible Than Ever

Mon, 21 Sep 2026 10:08:01 GMT

Trend Micro research documents new cybercrime underground tools including deepfake generators (DeepNude Pro, SwapFace, VideoCallSpoofer) and re-emerging malicious LLM services like WormGPT and DarkBERT with added multimodal capabilities. Many advertised jailbreak LLM services are actually thin wrappers around commercial models, and adoption of these tools by criminals remains relatively slow.

AI-Enabled (Attackers using AI) | Source: Trend Micro | Malware: DeepNude Pro, Deepfake 3D Pro, Deepfake AI, SwapFace, VideoCallSpoofer, WormGPT, DarkBERT, DarkGemini

Whose Voice Is It Anyway? AI-Powered Voice Spoofing for Next-Gen Vishing Attacks

Mon, 21 Sep 2026 10:07:53 GMT

Mandiant describes how attackers use AI voice cloning for vishing, including a red team case study where a cloned executive voice tricked an employee into bypassing security warnings and executing malware. It also cites a reported HK$200 million deepfake scam and offers mitigation guidance like code words and source verification.

AI-Enabled (Attackers using AI) | Source: Mandiant

State-Sponsored Russian Media Leverages Meliorator Software for Foreign Malign Influence Activity

Mon, 21 Sep 2026 09:58:33 GMT

FBI, CNMF, and allied agencies detail Meliorator, an AI-enhanced tool used by RT affiliates to mass-create fake social media personas that spread Russian disinformation on X. The software auto-generates biographical data and AI profile photos, bypasses two-factor authentication, and obfuscates IP addresses to evade detection.

AI-Enabled (Attackers using AI) | Source: FBI | Actors: RT | Malware: Meliorator, Brigadir, Taras, Faker | Attribution: Russia, per FBI, CNMF, AIVD, MIVD, DNP, CCCS (high confidence)