How Attackers Use AI in Cyberattacks (and How to Defend)

A few years ago, a convincing spear phishing email took a skilled operator real time to write. They had to research the target, mimic a plausible sender, get the tone right, and fix the grammar. That effort is why high-quality spear phishing used to be reserved for high-value targets. In a 2026 human-subject study, a fully automated AI system produced spear phishing emails that achieved a 54% click-through rate, matching human experts, at a cost of roughly four cents per email. The expensive part of the attack became cheap.

That single shift explains most of what is happening with AI and cybercrime right now. It is tempting to picture an autonomous AI hacker inventing attacks no human has seen. The evidence points somewhere more practical and, for defenders, more demanding. Attackers are using AI to do familiar things faster, cheaper, in more languages, and at greater scale. This article walks through how attackers actually use AI across the attack chain, and what companies can do to keep their margin from disappearing.

What AI Actually Changes About Attacks

The clearest way to think about AI in offensive operations is as a force multiplier, not a new attack category. The UK's National Cyber Security Centre frames it well: AI is expected to make intrusion operations more effective and efficient, increase the frequency and intensity of attacks, and widen the gap between organizations that keep pace and those that do not. It compresses the things that used to slow attackers down, including reconnaissance time, writing effort, language barriers, exploit adaptation, and coordination overhead.

Most observed misuse still maps to known techniques. The 2026 Verizon Data Breach Investigations Report frames current AI impact as operational acceleration rather than novel tradecraft. Google's threat intelligence reaches a similar conclusion: across the campaigns it has tracked, generative AI has mostly helped adversaries move faster and at higher volume rather than produce genuinely new capabilities. Both observations should temper the hype.

Neither should be read as reassurance. Cybersecurity is already a speed contest, and AI shortens the attacker's side of it. If reconnaissance, phishing, exploit adaptation, and post-compromise scripting all get faster, the defender's window to detect and respond shrinks even when the underlying techniques look the same. There is a real tension in the source material here, and it is worth stating plainly: AI has clearly changed attacker economics, but how much it changes any given company's breach probability depends on whether that company's defenses can keep pace operationally. The World Economic Forum's 2026 outlook found that the overwhelming majority of surveyed leaders now see AI as the single most significant driver of change in cybersecurity. The pressure is real even if the mechanics are familiar.

How Attackers Use AI for Social Engineering

The most immediate enterprise risk is not exotic. It is AI-enabled social engineering, because the bottleneck in most campaigns has never been exploit engineering. It is believable interaction with people. The 2026 DBIR found the human element present in 62% of breaches, and ENISA's 2025 threat landscape places social engineering at roughly 60% of observed initial access. AI makes every part of that more scalable.

Spear phishing moves from boutique to mass production. The study cited at the top is the cleanest evidence: automated AI spear phishing matched human experts on click-through at a fraction of the cost. AI handles the research, drafts in fluent local language, infers the target's role, and tests message variants. The limiting factor stops being writing skill and becomes target data and delivery infrastructure. The volume numbers reflect that shift. Microsoft's threat intelligence reported roughly 8.3 billion email-based phishing threats in the first quarter of 2026 alone, with QR-code phishing up 146% in the same window and business email compromise accounting for millions of attacks. Hoxhunt has reported that the share of phishing attacks showing signs of AI generation rose sharply across late 2025, though vendor figures like these are best read as reported observations rather than settled measurements.

Voice and video join the email. Voice phishing, or vishing, has become one of the most effective channels because phone calls carry an implicit trust that inboxes have lost. AI voice cloning needs only a short sample to produce a convincing executive or help-desk voice in real time. Deepfake video has moved from demonstration to fraud: in a widely reported 2024 case, an employee at the engineering firm Arup authorized transfers totaling roughly $25 million after a video call populated with deepfaked colleagues. Synthetic media also defeats identity checks. In a case decided by the Amsterdam District Court in June 2026, a man used face-swap imagery to beat a bank's selfie-versus-ID onboarding check and opened dozens of fraudulent accounts, having used a chatbot to research how to bypass identity verification.

The help desk is now a primary target. Several of 2026's most damaging intrusions started with a phone call, not a payload. The ShinyHunters cluster vished employees and help desks for single sign-on and OAuth access, then exfiltrated CRM data and extorted victims. Scattered Spider used help-desk social engineering against UK retailers including Marks & Spencer, talking support staff into resetting credentials or removing MFA, then escalating to ransomware with major operational cost. The Silent Ransom Group ran invoice-themed emails followed by fake IT-support callbacks against US law firms, installing remote-access tools and stealing documents within an hour. In each case, AI-grade pretexts and the attacker's willingness to pick the channel with the weakest verification mattered more than any technical exploit.

How Attackers Use AI on the Technical Side

The technical half of the chain is changing too, though more slowly and with important limits.

Vulnerability research and exploit development get an accelerant. NCSC identifies AI-assisted vulnerability research and exploit development as the most significant near-term technical development to watch. AI can help triage disclosures, interpret patches, adapt proof-of-concept code, and write the glue code around an exploit. The practical effect lands first on n-day exploitation: the window between a patch being published and that vulnerability being weaponized keeps shrinking, which punishes slow patch cycles.

The capability is real but uneven, and overclaiming it costs credibility with a technical audience. Benchmarks like VulDetectBench show that current models do well at higher-level vulnerability identification and classification but poorly at detailed root-cause analysis, key functions, and trigger points. In other words, AI today is a junior-to-midlevel accelerator working under human supervision, not a standalone expert exploit developer.

Agentic workflows are emerging, with caveats. Research on multi-agent systems, where one agent plans and others specialize in tasks like SQL injection or cross-site scripting, has shown non-trivial success against real-world web vulnerabilities in controlled benchmarks. That is a meaningful signal about the direction of travel. It should be read carefully. As critical reviews of these testbeds point out, most lack active defenders, realistic enterprise noise, and messy dependencies, so the results indicate trajectory rather than predicting breach rates. Fully autonomous, end-to-end advanced intrusion remains unlikely in the near term, consistent with NCSC's assessment. The realistic picture is autonomous components, such as recon, phishing setup, exploit adaptation, and data triage, rather than autonomous campaigns.

The barrier to entry drops. Purpose-built malicious models marketed under names like WormGPT and FraudGPT strip the safety guardrails off language models and sell the result on criminal forums. They do not give a novice elite capability, but they lower the floor, which means more actors can produce decent phishing content and basic scripts without skill or scruples.

Why the Human and Technical Sides Reinforce Each Other

Treating "human" and "technical" risk as separate programs is the mistake AI punishes most, because it links them into a loop.

It runs like this. AI improves social engineering, which yields credentials, session tokens, OAuth grants, or a help-desk reset. That identity access opens up SaaS systems, cloud consoles, code repositories, and internal documentation, and at that point the attacker often does not need an exploit. Identity is the exploit. The internal context they collect, including org charts, email threads, vendor relationships, and ticket histories, makes the next round of social engineering far more credible, and AI can summarize that material and generate tailored pretexts in minutes. From there, vulnerabilities and misconfigurations expand the blast radius, and stolen data feeds extortion and fraud. A technical vulnerability becomes social engineering material; a social engineering success becomes a technical intrusion. AI reduces the friction at every handoff. The defensive implication is that identity, endpoint, help-desk process, and SaaS telemetry have to be managed as one connected problem.

Your Own AI Is a New Attack Surface

There is a second surface that phishing-focused coverage tends to skip: the AI your own organization is adopting.

The most discussed risk is prompt injection, where instructions hidden in content the model reads, such as a web page, a document, or an email, hijack its behavior. Indirect prompt injection is especially relevant once an AI agent is connected to tools. A chatbot that can only talk is an information risk. An agent that can read mailboxes, open tickets, query databases, or call cloud APIs is an execution risk, and the question shifts from "can the model say something wrong" to "what can the model do when manipulated."

Then there is shadow AI. The 2026 DBIR's findings on unsanctioned AI use are pointed: employees regularly use non-corporate AI accounts on work devices, and source code is among the most common data types submitted to external AI tools. Sensitive business context can leave the organization before security has any logging, retention, or contractual control in place. That makes AI governance a data-security issue, not just an innovation-policy one.

What Companies Can Do to Defend

None of this calls for panic, and none of it is solved by a single product. It calls for tightening the controls that AI-accelerated attacks press on hardest. The following is a practical order of operations.

Harden identity against AI-enabled social engineering

If identity is the exploit, identity is the priority. Roll out phishing-resistant MFA, such as passkeys or hardware security keys, for administrators, finance, help desk, developers, cloud operators, and executives first, and reduce dependence on SMS and push approvals that social engineering can defeat. Just as important is process: enforce out-of-band verification for help-desk password and MFA resets, control OAuth consent and device-code flows, and shorten session lifetimes. The CISA, NSA, FBI, and MS-ISAC guidance on stopping intrusions at initial access lands on the same point, that phishing is now an identity, SaaS, and help-desk control problem, not only an email problem.

Rebuild vulnerability management around exploit speed

Because AI compresses the time from disclosure to exploitation, monthly patch cycles without compensating controls carry more real exposure than they used to. Maintain an accurate inventory of internet-facing assets, rank vulnerabilities by exploitability and active exploitation rather than raw CVSS, and define emergency and virtual-patching paths using WAF and EDR mitigations when immediate patching is not possible. Track the metric that matters: time from disclosure to verified exposure reduction.

Govern enterprise AI use as data security

Inventory the AI tools actually in use, sanctioned or not, and control AI browser extensions and plugins. Define what data may be submitted to external models, require enterprise accounts with logging and retention controls, and extend data-loss monitoring to cover source code, secrets, and customer data flowing into GenAI tools.

Treat AI agents as privileged applications

Any AI system with access to email, files, code, cloud APIs, or workflow automation deserves the controls you would put on a privileged account: least privilege, scoped tools, rate limits, logging, and explicit human confirmation for high-impact actions. Test these systems for direct and indirect prompt injection before you connect them to anything that matters.

Use AI defensively, but validate its output

The same acceleration is available to defenders. AI helps with phishing analysis, alert triage, detection engineering, vulnerability prioritization, and incident summaries, and the point is to cut time spent on repetitive analysis, not to remove human judgment. Outputs still need verification, provenance, and accountability, particularly given the SOC-focused benchmarks showing that unguided models still miss most malicious activity in realistic threat-hunting tasks.

Move beyond annual awareness training

Training matters, but the research is honest about its limits. A meta-analysis of end-user security training finds a positive overall effect, with behavioral change smaller than the change in knowledge or attitude, and weak long-term evidence. The practical signals are familiar to anyone who runs a program: Fortinet's 2025 survey found that while 94% of organizations run regular training, only 6% achieve full completion and roughly 69% still feel their people lack adequate awareness. What moves behavior is point-of-error reinforcement, with one body of research associating just-in-time, point-of-failure training with around a 40% reduction in susceptibility. Pair training with the controls above, with easy reporting, and with verification workflows for payment changes and unusual requests, so that a single human mistake is not the whole defense.

What AI-Grade Spear Phishing Training Has to Simulate Now

That last point has a specific consequence. If attackers run personalized, multi-channel spear phishing for four cents a message, then training built around generic, link-only email tests is rehearsing for the wrong attack. Useful simulation in 2026 has to look like what people actually face: phishing personalized from real role and tooling context, voice and vishing scenarios including cloned-voice pretexts, and deepfake awareness. It has to scale difficulty realistically, measure behavior rather than only click rate, and trigger follow-up at the moment someone fails. Those criteria are a reasonable lens for evaluating the platforms below.