How hackers and scammers use AI for cyber attack

Key Points

• Research suggests hackers and scammers are using AI to enhance cyber attacks, making them more sophisticated and harder to detect.
• It seems likely that AI is used for adaptive malware, phishing, deepfakes, automated attacks, password cracking, CAPTCHA solving, and social engineering.
• The evidence leans toward AI-powered attacks increasing, with examples like DeepLocker malware and potential use in high-profile incidents like the Colonial Pipeline attack.
• An unexpected detail is that while specific recent AI-powered attack cases are limited, the potential for misuse is growing, especially with tools like WormGPT.

Introduction to AI in Cyber Attacks

AI, or Artificial Intelligence, refers to computer systems capable of tasks like learning and problem-solving, typically requiring human intelligence. In cyber attacks, hackers are leveraging AI to make their methods more efficient and adaptive, posing new challenges for cybersecurity.

How Hackers Use AI

Hackers are using AI in several ways to enhance their attacks:

• Adaptive Malware: AI creates malware that changes to evade detection, like the DeepLocker malware demonstrated in 2018, which activates only for specific targets.
• Phishing Attacks: AI generates convincing, personalized emails, increasing the likelihood of tricking users into revealing sensitive information.
• Deepfake Technology: AI produces realistic fake videos and audio for impersonation or misinformation, such as deepfake videos used in scams.
• Automated Attacks: AI automates vulnerability scanning and attack execution, speeding up the process.
• Password Cracking: AI analyzes patterns to guess passwords more effectively, enhancing brute-force attacks.
• CAPTCHA Solving: AI bypasses security measures by solving CAPTCHAs, enabling automated malicious actions.
• Social Engineering: AI crafts tailored messages by analyzing online activities, making social engineering attacks more persuasive.

Real-World Examples and Protection

While specific recent examples are scarce, notable cases include the 2018 DeepLocker malware and potential AI enhancements in the 2021 Colonial Pipeline attack. To protect against these, use multi-factor authentication, keep software updated, and be cautious with emails and links. Educating yourself on recognizing AI-generated content is also crucial.

Survey Note: Detailed Analysis of Hackers Using AI for Cyber Attacks

This survey note provides a comprehensive examination of how hackers and scammers are leveraging Artificial Intelligence (AI) for cyber attacks, based on extensive research and analysis. The focus is on understanding the methods, real-world applications, and protective measures, ensuring a thorough exploration for readers interested in cybersecurity trends as of March 30, 2025.

Background and Definition

AI, or Artificial Intelligence, encompasses computer systems designed to perform tasks typically requiring human intelligence, such as learning, reasoning, and problem-solving. In the context of cyber attacks, hackers are using AI to enhance the sophistication and efficiency of their malicious activities, making detection and mitigation more challenging. This misuse is particularly concerning given AI’s ability to adapt and evolve, mirroring its beneficial applications in industries like healthcare and finance.

Methods of AI Utilization in Cyber Attacks

Hackers are employing AI in several distinct ways to amplify their cyber attack capabilities. Below is a detailed breakdown, supported by research and examples:

1. Adaptive Malware
   • AI is used to create polymorphic malware, which changes its code to evade detection by antivirus software. This adaptability makes it difficult for security systems to identify and neutralize threats.
   • A notable example is the DeepLocker malware, demonstrated by IBM in 2018, which uses AI for targeted activation based on facial recognition, geolocalization, or voice recognition, remaining hidden until it reaches its intended victim. This proof-of-concept highlights the potential for real-world deployment, with research suggesting it could affect millions of systems undetected (CISO MAG).
2. Phishing Attacks
   • AI generates highly convincing emails and documents for phishing campaigns, mimicking legitimate sources with proper grammar and personalization. This increases the success rate of deceiving users into disclosing sensitive information.
   • Research indicates that AI-automated phishing can be more effective, with some studies suggesting up to 60% of participants falling victim compared to non-AI methods, reducing costs by over 95% (Sangfor Technologies). The FBI has warned of AI-driven phishing campaigns becoming more targeted, exploiting trust with tailored messages (FBI).
3. Deepfake Technology
   • AI creates realistic fake images, videos, and audio for impersonation or spreading misinformation. Deepfakes can be used in scams, such as impersonating company officials to authorize fraudulent transactions or manipulate public opinion.
   • Statistics show that 66% of cybersecurity professionals experienced deepfake attacks in 2022, underscoring their growing prevalence (World Economic Forum). An example includes deepfake videos of celebrities used in crypto investment scams, like the 2022 case involving Patrick Hillmann, former CCO of Binance (Sangfor Technologies).
4. Automated Attacks
   • AI automates the reconnaissance and execution phases of cyber attacks, such as scanning for vulnerabilities, identifying exploitable assets, and launching attacks. This reduces the time and human effort required, enabling faster and more efficient attacks.
   • Research from CrowdStrike highlights that AI can shorten the research phase, potentially improving accuracy and completeness, making automated attacks a growing concern (CrowdStrike).
5. Password Cracking
   • AI analyzes user behavior and patterns to enhance brute-force attacks, guessing passwords more effectively. By learning from typing patterns or common password choices, AI increases the success rate of cracking credentials.
   • This method is particularly effective against weak passwords, with AI tools achieving up to 95% accuracy in keystroke listening, as noted in cybersecurity reports (Sangfor Technologies).
6. CAPTCHA Solving
   • AI can solve CAPTCHAs, which are designed to prevent automated attacks, allowing bots to perform actions like account creation or spreading spam. This bypasses a traditional security measure, enabling further malicious activities.
   • The capability is facilitated by AI’s image and pattern recognition, making it a tool for automating attacks that were previously human-dependent (TechTarget).
7. Social Engineering
   • AI crafts personalized and convincing social engineering attacks by analyzing targets’ social media or online activities. This tailoring increases the persuasiveness, making victims more likely to comply with requests for sensitive information.
   • Examples include AI-generated messages mimicking trusted contacts, with tools like WormGPT, discovered in 2023, generating persuasive phishing emails for business email compromise attacks (ZDNET). This tool, based on the GPT-J language model, lacks ethical boundaries, enhancing its malicious potential.

Real-World Examples and Case Studies

While specific recent AI-powered attack cases are not always publicly detailed due to their sensitive nature, several notable instances and trends provide insight:

• DeepLocker Malware (2018): A proof-of-concept by IBM, hiding WannaCryptor ransomware in a videoconferencing app, activating only upon recognizing the victim’s face using public photos. This demonstrates AI’s potential for targeted, evasive attacks (ESET).
• Colonial Pipeline Attack (2021): While not explicitly AI-powered, the DarkSide group’s ransomware attack highlighted vulnerabilities, with research suggesting AI could enhance similar attacks for efficiency and evasion (ESEDSL).
• Google Docs Phishing (2017): Hackers used AI to create a malicious app resembling Google Docs, collecting user data, showcasing early AI use in phishing (ESEDSL).
• WormGPT and HackedGPT: Recent tools like WormGPT, promoted on hacker forums, generate malware and phishing emails, illustrating the growing availability of AI for cybercrime (ZDNET).

An unexpected detail is the rapid proliferation of such tools, with dark web forums offering AI-based malware creation, and prices ranging from $100/month to thousands for private setups, indicating a burgeoning market for AI-driven cybercrime (Sangfor Technologies).

Protective Measures and Strategies

To safeguard against AI-powered cyber attacks, individuals and organizations can adopt the following measures:

• Multi-Factor Authentication (MFA): Adds an extra layer of security, making it harder for attackers to gain access even if passwords are compromised.
• Regular Software Updates: Ensures systems are patched against known vulnerabilities, reducing the risk of exploitation.
• Caution with Emails and Links: Be wary of overly personalized or suspicious messages, especially those with links or attachments, and verify their legitimacy before interacting.
• Education and Awareness: Train employees and individuals to recognize AI-generated content, such as deepfakes or phishing emails, and understand social engineering tactics.
• AI-Powered Security Tools: Leverage AI for defense, such as firewalls using Deep Learning to detect unknown malware, as seen in industry practices (ESEDSL).

Research suggests that a multi-layered security approach, combining traditional and AI-driven tools, is essential to combat these evolving threats, with the global market for AI-based cybersecurity products projected to reach $133.8 billion by 2030 (Sangfor Technologies).

Statistical Insights and Trends

The following table summarizes key statistics related to AI-powered cyber attacks, highlighting their impact and growth:

These statistics underscore the increasing prevalence and sophistication of AI-powered attacks, necessitating robust defensive strategies.

Conclusion and Future Outlook

As of March 30, 2025, the misuse of AI by hackers and scammers is a growing concern, with methods like adaptive malware, deepfakes, and automated attacks becoming more common. While specific recent examples are limited, the potential for misuse is evident, especially with tools like WormGPT and HackedGPT. To stay protected, individuals and organizations must adopt a proactive approach, leveraging AI for defense and staying informed about emerging threats. The future likely holds increased integration of AI in both attack and defense, requiring continuous adaptation and education.

Key Citations

• CISO MAG hackers using AI
• Sangfor Technologies defining AI hacking rise AI cyber attacks
• ASU News AI driven cyberattacks more sophisticated and scalable
• TechTarget how hackers use AI and machine learning to target enterprises
• CSO Online 10 ways hackers will use machine learning to launch attacks
• Techopedia AI in cybersecurity the future of hacking is here
• Prey Project how to combat AI cybersecurity threats
• OXEN Technology how do hackers use AI
• CrowdStrike most common AI powered cyberattacks
• NIST identifies types of cyberattacks that manipulate behavior of AI systems
• ESEDSL examples of cyberattacks launched with artificial intelligence
• ScienceDirect weaponized AI for cyber attacks
• Mixmode what are AI generated attacks
• Redress Compliance top 15 real life use cases for AI in the cybersecurity industry
• Fortinet AI in cybersecurity key benefits defense strategies future trends
• TechMagic AI in cyber security top 6 use cases
• World Economic Forum how can we combat the worrying rise in deepfake content
• ZDNET wormGPT what to know about chatgpts malicious cousin
• ESET Quasar Sobaken Vermin malware report
• FBI warns of increasing threat of cyber criminals utilizing artificial intelligence
• Quarles Law Firm warning ChatGPT exploit used by threat actors in cyber attacks