{"id":3049,"date":"2026-10-08T13:47:01","date_gmt":"2026-10-08T13:47:01","guid":{"rendered":"https:\/\/aiunplugged.io\/blog\/?p=3049"},"modified":"2026-10-08T13:47:01","modified_gmt":"2026-10-08T13:47:01","slug":"how-criminals-use-ai-in-cyber-attacks","status":"publish","type":"post","link":"https:\/\/aiunplugged.io\/blog\/how-criminals-use-ai-in-cyber-attacks\/","title":{"rendered":"How Criminals Use AI in Cyber Attacks"},"content":{"rendered":"\n

Not long ago, most phishing emails were easy to recognise. They had odd grammar, a greeting like \u201cDear Costumer,\u201d and an urgent request to \u201ckindly verify\u201d your bank details. That has changed a lot. Now a similar email can come in flawless English or Arabic. It may use your actual manager\u2019s name and refer to a project from last week. Attackers have started using artificial intelligence, the same as everybody else.<\/p>\n\n\n\n

Old crimes, faster tools<\/strong><\/h2>\n\n\n\n

Phishing, malware and password attacks were around long before chatbots, so AI didn\u2019t create them. It made them quicker and bigger. A criminal who once managed around ten believable emails a day can now send thousands, and every one can be adjusted for a single person. A job that once needed a trained team is now possible for one person with a laptop and some well-written prompts.<\/p>\n\n\n\n

Phishing emails that read well<\/strong><\/h2>\n\n\n\n

Language models write text that sounds natural, and attackers take advantage of that. They gather public details from LinkedIn, company websites or social media and ask a model to copy the company\u2019s normal way of writing. What comes out doesn\u2019t look like spam at all. It reads like an ordinary message from HR.<\/p>\n\n\n\n

In 2023, tools called WormGPT and FraudGPT were sold on criminal forums as \u201cAI without limits.\u201d I suspect some of them were mostly hype. The basic idea behind them works, though, and it will probably stay with us.<\/p>\n\n\n\n

Malware that keeps changing<\/strong><\/h2>\n\n\n\n

Older antivirus programs mainly used signatures, which means they looked for known pieces of malicious code. With AI, an attacker can rewrite the same code many times so each copy looks a bit different. Beginners can also get help writing scripts they couldn\u2019t manage alone.<\/p>\n\n\n\n

AI-generated malware is often full of bugs, and a beginner doesn\u2019t become an expert overnight. What worries security people more is that getting started is now much easier. More people try, and some of them get lucky.<\/p>\n\n\n\n

Quicker research before an attack<\/strong><\/h2>\n\n\n\n

Attackers first need to know which systems a company runs, who works there and which servers can be reached from the internet. Collecting this used to take days or even weeks. AI lets them summarise leaked data, go through scan results and spot weaknesses in far less time. The attack may look familiar, but the planning behind it happens faster.<\/p>\n\n\n\n

AI on the defending side<\/strong><\/h2>\n\n\n\n

Security teams use AI too, and in many cases they get more out of it. Modern EDR tools and SIEM platforms rely on machine learning to notice strange behaviour. One example is a user who logs in from two countries within one hour. Another is a laptop that starts uploading huge amounts of data at 3 a.m.\u00a0Analysts in a Security Operations Centre can receive thousands of alerts a day<\/u><\/a>, and AI helps them sort out which ones need attention first. Attackers and defenders are both speeding up at the same time.<\/p>\n\n\n\n

Practical steps<\/strong><\/h2>\n\n\n\n

Basic defences still work, and they matter more than before.<\/p>\n\n\n\n