How Hackers Are Using AI to Accelerate Cyberattacks

Introduction

A convincing phishing email takes time to research and write. An unfamiliar programming language could slow an attacker down. Sorting through stolen documents required effort. Artificial intelligence can shorten each of those tasks.

Cybercriminals are using AI to support research, generate deceptive content, assist with code, and automate parts of their operations. The result is a threat businesses need to understand: familiar attack methods can become faster to prepare, easier to repeat, and more practical to personalize.

The UK’s National Cyber Security Centre assesses that AI will almost certainly make elements of cyber intrusion more effective and efficient through 2027. That is a forecast about increasing capability, not a claim that every attack already uses AI.

For businesses, the priority is to understand where that acceleration creates exposure and strengthen the controls that interrupt an attack.

What Does an AI-Enabled Cyberattack Look Like?

An AI-enabled cyberattack uses artificial intelligence to assist one or more stages of malicious activity. Human operators may still choose the target, obtain access, and make important decisions.

The level of automation varies. One attacker might use a language model to rewrite a fraudulent message. Another might connect an AI agent to tools that support a longer sequence of tasks.

It helps to distinguish three situations:

• AI-assisted attacks: AI helps a person research, write, analyze, or develop code.
• AI-orchestrated attacks: An AI agent coordinates parts of an operation through connected tools.
• Attacks against AI systems: An attacker targets an organization’s AI application, data, or integrations.

These situations can overlap, but they require different defensive questions. Businesses need to consider both how attackers use AI and how their own AI systems could become an entry point.

How Does AI Help Attackers Work Faster?

AI’s value to an attacker often comes from reducing repetitive work. Tasks that previously required manual drafting, translation, troubleshooting, or analysis can become quicker.

That does not guarantee a successful attack. An AI-generated message still needs to reach someone. Malicious code still needs an opportunity to run. An attempted intrusion still depends on weaknesses in access controls, software, or business processes.

However, reducing preparation time allows attackers to try more variations and pursue more opportunities. For defenders, that makes consistency important. A security control that works only when an employee notices an unusual spelling mistake is increasingly fragile.

1. Writing More Convincing Phishing Messages

Phishing attempts often impersonate a trusted organization or person to persuade someone to reveal credentials, open a file, or approve a request.

• AI can help attackers produce fluent messages in different languages and adapt the wording to a particular role. A finance employee might receive a payment-related request, while a recruiter receives an apparent candidate document.
• Microsoft’s 2025 Digital Defense Report identifies AI-automated phishing among the techniques threat actors are adopting.
• For businesses, the practical implication is clear: polished writing is not evidence that a message is legitimate.

Teach employees to examine the requested action. Unexpected login links, payment changes, sensitive attachments, and pressure to bypass normal approval deserve verification, regardless of how professional the message sounds.

2. Making Impersonation More Believable

Synthetic audio and video can add another layer to social engineering. An apparent voice message from a familiar person may encourage a recipient to trust a request without checking it.

• Microsoft describes synthetic media and scaled social engineering as ways threat actors are using AI.
• Consider an illustrative scenario: an employee receives an urgent voice message that appears to come from an executive, followed by instructions to change a supplier’s bank details.
• The danger comes from combining apparent familiarity with a consequential action.

Verify sensitive requests through an established, independent channel. Use a known contact number or approved internal process. Require additional approval for payment changes and other high-impact actions.

3. Accelerating Research and Target Selection

Before attempting an intrusion, attackers may research an organization’s people, technology, suppliers, and public-facing services.

• AI can help organize available information and identify details worth further investigation. The NCSC’s assessment identifies reconnaissance and vulnerability research as areas where AI can enhance cyber operations.
• This can make public information more useful to an attacker. A job advertisement, employee biography, or technical document may provide context for a believable approach.

Review unnecessary public exposure of technical and operational details. Maintain an accurate inventory of internet-facing services, including older systems that may no longer have an active owner.

4. Supporting Malicious Code Development

AI coding assistance can reduce time spent explaining unfamiliar code, fixing errors, or adapting scripts. Attackers can misuse these capabilities just as legitimate developers use them productively.

• Microsoft reported a credential-phishing campaign in September 2025 that likely used AI-generated code to obscure its payload. The company described the AI involvement as likely, which is an important qualification.
• AI involvement does not automatically make malicious code undetectable. Defenders can still examine behavior, destinations, execution patterns, and other indicators.

Keep endpoint protection active, restrict unnecessary execution privileges, and investigate suspicious behavior rather than depending only on recognition of a specific file.

5. Shortening Vulnerability Investigation

AI can assist with analyzing technical documentation and understanding software behavior. In malicious hands, this can support faster investigation of potential weaknesses.

• The NCSC expects AI to improve vulnerability research and exploit development, increasing pressure on organizations with exposed or outdated systems.
• Businesses should treat this as a reason to reduce preventable exposure. They should not assume that AI can reliably discover or exploit every weakness.

Prioritize remediation according to exposure and business impact. Internet-facing systems, identity infrastructure, and vulnerabilities known to be exploited deserve prompt attention.

6. Coordinating Parts of an Attack

AI agents can connect language-model reasoning with tools and repeated actions. This creates opportunities for legitimate automation, but also for malicious use.

• In November 2025, Anthropic reported disrupting a cyber espionage campaign detected in September that year.
• According to its investigation, the attackers used AI to perform substantial parts of the operation, while people remained involved at important decision points. Anthropic also reported mistakes by the model, including inaccurate claims about findings.
• The example shows both the potential for greater automation and its limits. It should not be treated as evidence that every attacker can reliably run a fully autonomous campaign.

Monitor service accounts, automated workflows, unusual access sequences, and unexpected outbound activity. Give integrations narrowly defined permissions and ensure authorized teams can suspend them quickly.

Why Does This Matter for Smaller Businesses?

A business does not need to be a prominent target to face phishing, account compromise, or fraudulent payment requests.

Microsoft’s investigation of the AI-obfuscated phishing campaign found that the malicious emails were distributed through a compromised small-business email account. A trusted account can become part of an attack against other organizations.

Smaller teams should therefore focus on practical controls they can operate consistently: secure accounts, clear approval procedures, timely updates, reliable backups, and a simple incident response plan.

What Warning Signs Should Teams Investigate?

Many warning signs remain familiar even when AI supports the attack. Teams should investigate:

• Unexpected requests to change payment details or share credentials.
• Login activity inconsistent with the account’s normal use.
• New forwarding rules or unexplained changes to account settings.
• Large or unusual downloads and exports.
• Automated activity outside an integration’s approved purpose.
• Unexpected outbound connections or newly granted access.
• Repeated attempts to perform a blocked action.

These indicators do not prove AI involvement. They identify behavior worth examining.

Determining whether AI helped an attacker may be useful later. Containing unauthorized activity comes first.

How Can Businesses Reduce the Risk?

Strengthen Identity Protection

Use phishing-resistant multifactor authentication where supported. Review privileged accounts and remove unnecessary access. Account protection should extend to service accounts and integrations.

Verify Consequential Requests

Establish clear procedures for payments, banking changes, sensitive exports, and account recovery. Employees should be able to pause a suspicious request without feeling pressured to complete it.

Reduce Exposed Weaknesses

Keep systems updated, identify unsupported software, and review external access. Assign responsibility for remediation so findings lead to action.

Monitor Actions Across Connected Systems

Correlate relevant identity, email, endpoint, cloud, and application records. A sequence of small anomalies may reveal a problem that an isolated alert misses.

Protect Your Own AI Workflows

Document what each AI application can access and do. Restrict permissions, require approval for consequential actions, and maintain a circuit breaker that authorized people can use to stop execution.

Prepare for Recovery

Test backups and incident response procedures. Define who can suspend accounts, disconnect integrations, preserve evidence, and authorize restoration.

These measures should be implemented as part of the organization’s security program. Their effectiveness depends on correct configuration, maintenance, and regular testing.

Know Your AI Risk Before Attackers Exploit It

AI is changing the speed and economics of cyberattacks. It can reduce preparation time, support more convincing deception, and help coordinate complex activity.

Businesses can respond by making trust more deliberate: verify sensitive requests, limit access, monitor consequential actions, and prepare to intervene.

For organizations adopting AI, that also means understanding their own agents and integrations. A productive workflow needs a clear owner, defined permissions, and an effective way to stop unauthorized activity.

Don’t let your AI go rogue. Connect with BlackSeedAI to discuss your AI security and governance priorities. Get a demo and assessment today.