AI Threat Landscape

Year: 2026 · Published 6 May 2026

Fill in your details to access the complete intelligence brief.

AI Threat Landscape Report

Hackers’ AI Advantage

Artificial intelligence is changing cybercrime less by creating entirely new attack categories and more by removing the friction that once kept existing ones slower, smaller, and harder to run. Fraud, phishing, vishing, identity abuse, reconnaissance, and malicious tooling all become more dangerous when language generation, workflow automation, voice synthesis, and data processing stop being specialist capabilities and start becoming easy-to-deploy services.

Phishing statistics

54%

Stealer concentration

86%

Voice fraud growth

1,600%

AI credential records

3.1M+

AI Has Become Standard Infrastructure for Cybercrime

Agentic Workflows Move Fraud Toward Automation

The important shift is not only that individual tools are becoming more capable. Cybercrime services are increasingly combining multiple functions into repeatable systems with dashboards, prompts, workflows, support channels, delivery logic, and built-in configuration options.

Cybercrime Is Moving From Tools to Managed Systems

The important shift is not only that individual tools are becoming more capable. Cybercrime services are increasingly combining multiple functions into repeatable systems with dashboards, prompts, workflows, support channels, delivery logic, and built-in configuration options.

This changes the operating model for attackers. Buyers no longer need to understand every technical layer when platforms package the process for them. Instead of building infrastructure, writing scripts, testing lures, setting up delivery, and troubleshooting failures separately, an operator can move through a guided interface and launch activity with fewer manual steps.

The result is a more service-like underground economy. A single tool may fail or require expertise, but a managed system can help users test, adjust, retry, and scale. This is why AI-enabled cybercrime should not be viewed only as better malware or better phishing text. Its larger impact is the way it turns complex activity into repeatable, supported workflows.

The central risk is operational compression. AI reduces the time, skill, and infrastructure needed to move from intent to execution, allowing more actors to participate and allowing experienced actors to move faster.

01 · Cybercrime Is Moving From Tools to Managed Systems

Dark LLMs Turn Refusal-Free Output Into a Service

Phishing Cloaking Filters Out Defenders

Deliverability Becomes Part of the Phishing Product

Voice fraud growth

1,600%

1,600%+ growth was observed in deepfake-enabled vishing activity in Q1 2025.

Phishing performance

4.5x

4.5x increase in click-through performance was observed for AI-automated phishing compared to standard attempts.

Credential exposure

56

56 seconds was enough for one documented automated vishing session to end in credential capture.

Phishing and Voice Fraud Scale Through Friction Loss

Key Statistics

AI gives attackers more than better wording. It helps them test, deliver, personalize, and repeat campaigns at higher volume with fewer operators.

Vishing Setup Moves Into a Dashboard

Call Flow Becomes Configurable Fraud Logic

Credential Capture Happens Mid-Call

Identity Fraud Is Entering an Escalation Cycle

Key Findings

Identity verification has become a major barrier for fraud operations, so attackers are investing in tools that target liveness checks, document quality, and verification logic.

KYC Bypass Tools Target Liveness Checks

Synthetic Identity Becomes Self-Service

Fraud Actors Refine the Logic Behind Fake IDs

AI is also becoming an operational support layer inside criminal ecosystems. It can answer buyer questions, maintain forum personas, process stolen data, summarize logs, draft posts, and keep underground services active without constant human staffing.

AI Support Becomes Criminal Infrastructure

AI is also becoming an operational support layer inside criminal ecosystems. It can answer buyer questions, maintain forum personas, process stolen data, summarize logs, draft posts, and keep underground services active without constant human staffing.

This matters because cybercrime is not only about malware, phishing, or fraud pages. It also depends on communication, reputation, customer support, data preparation, and service continuity. AI can help small teams appear more available, more organized, and more responsive than they actually are.

That creates a stronger service model. A threat actor can use automation to respond to buyers, explain product features, structure stolen records, or maintain activity across communities. Even when the technical capability itself is not new, the surrounding support system becomes faster and easier to sustain.

02 · AI Support Becomes Criminal Infrastructure

AI Accounts Maintain Forum Presence

Romance Scam Bots Automate Emotional Manipulation

Leak Processing Turns Raw Data Into Targeting Material

AI Training Data Becomes a Supply Chain Target

Offensive tooling is shifting in two directions at once. AI accelerates the creation of malicious tools, while public trust in AI products gives attackers a new wrapper for lures, fake utilities, and malware delivery.

AI-Masked Tooling Changes Malware Marketing

Offensive tooling is shifting in two directions at once. AI accelerates the creation of malicious tools, while public trust in AI products gives attackers a new wrapper for lures, fake utilities, and malware delivery.

At the same time, some actors now distance themselves from AI-generated malware. As low-effort AI-built tools become more common, “not AI-made” can turn into a quality signal for buyers who want stability, maintenance, and fewer broken features.

This is an important underground market signal. AI is no longer just a capability claim. It is also part of how sellers position their products. Some advertise AI-assisted evasion and automation, while others use the absence of AI as a way to suggest higher quality and stronger engineering.

The larger point is normalization. AI has become common enough in underground tooling that both its presence and its absence can be used for marketing. That shows how quickly AI has moved from novelty to expected context in malware and fraud ecosystems.

03 · AI-Masked Tooling Changes Malware Marketing

AI-Enhanced Crypters Market Evasion at Build Time

“Not AI-Made” Becomes a Quality Claim

Part One shows AI moving from an experimental add-on to an operational layer inside cybercrime. It supports phishing delivery, vishing, fraud workflows, support bots, leak processing, evasion tooling, and the packaging of criminal services.

Part One Shows AI as Criminal Infrastructure

Part One shows AI moving from an experimental add-on to an operational layer inside cybercrime. It supports phishing delivery, vishing, fraud workflows, support bots, leak processing, evasion tooling, and the packaging of criminal services.

The broader pattern is consolidation. Criminal services are becoming easier to buy, easier to configure, and easier to repeat. AI does not need to replace the operator entirely to change the economics of cybercrime. It only needs to remove enough friction from each stage of the workflow.

Specialist skills are being packaged into services, while defensive improvements are driving attacker adaptation. The result is an underground market that looks more like a product ecosystem, with interfaces, support channels, feature updates, and competing claims about quality.

The key takeaway is that AI is becoming infrastructure. It helps criminals communicate, build, test, deliver, process, and scale. That makes it harder to separate “AI abuse” from the broader cybercrime service economy.

04 · Part One Shows AI as Criminal Infrastructure

AI does not need to invent new attack classes to change the threat landscape. Its bigger effect is reducing the skill, time, and effort required to execute known techniques across the attack chain.

AI Lowers the Skill Floor Across the Attack Chain

AI does not need to invent new attack classes to change the threat landscape. Its bigger effect is reducing the skill, time, and effort required to execute known techniques across the attack chain.

Four usage clusters stand out: jailbroken generative AI, abuse of legitimate tools, deepfake and social engineering operations, and autonomous attack infrastructure. Each cluster removes a different bottleneck. Some reduce the need for coding skill, while others reduce the need for language fluency, operational experience, or manual research.

This is why AI-enabled threats should not be measured only by whether they produce advanced new capabilities. In many cases, the output may be basic, flawed, or derivative. The real change is that more actors can reach a usable starting point faster and then improve through iteration.

The common thread is acceleration. Tasks that once required research, scripting, infrastructure knowledge, or social engineering experience can now be supported by prompts, templates, agents, and guided interfaces.

05 · AI Lowers the Skill Floor Across the Attack Chain

Uncensored Local Models Produce Basic C2 Skeletons

Iterative Prompting Improves Attack Architecture

Legitimate AI services can become part of an attack workflow even when they are not designed for offensive use. The danger comes from the chain, not from one tool alone.

Mainstream AI Can Become Attack Infrastructure

Legitimate AI services can become part of an attack workflow even when they are not designed for offensive use. The danger comes from the chain, not from one tool alone.

One service may support exploitation logic, another may structure stolen data, and another may help organize outputs or prepare follow-on activity. None of these steps necessarily requires a purpose-built criminal AI tool. Normal features can become attack infrastructure when they are connected with adversarial intent.

This makes defensive visibility harder. Security teams may focus on obvious underground tools while overlooking the way ordinary AI services, browser extensions, automation platforms, and developer assistants can be combined into an operational chain.

The risk is not always the model itself. The risk often appears when AI systems are connected to data, tools, credentials, and workflows that allow generated output to influence real actions.

06 · Mainstream AI Can Become Attack Infrastructure

WormGPT Reduces Friction Around Harmful Code

Legitimate AI Tools Can Be Chained Into Attack Workflows

AI Assistants Accelerate Reconnaissance

AI-based detection is highly sensitive to file context. Metadata can improve performance, while stripped or altered metadata can weaken confidence and increase both missed detections and false positives.

Deepfake Detection Depends on Context

AI-based detection is highly sensitive to file context. Metadata can improve performance, while stripped or altered metadata can weaken confidence and increase both missed detections and false positives.

This creates a practical problem for identity, onboarding, and access-control workflows. In controlled tests, detection may look more reliable when files retain useful context. In real fraud scenarios, however, files may be compressed, edited, copied, re-exported, or stripped of metadata before they reach the review process.

That means detection should be treated as one signal, not the final decision. A model verdict needs to be supported by process controls, document checks, behavioral signals, manual review paths, and a clear understanding of how the file was obtained.

The weakest point is overconfidence. If teams treat AI detection as a standalone truth source, attackers can exploit uncertainty while legitimate users may face false accusations.

07 · Deepfake Detection Depends on Context

Security Agents Make Offensive Workflows More Accessible

AI Image Detection Depends on Metadata

Detection Weakens When Metadata Disappears

Real Images Create False-Positive Risk

Metadata Improves AI Image Detection

Detection Weakens When Metadata Disappears

Real Images Can Still Trigger False Positives

No-Metadata Real Images Are the Hardest Test

AI-generated images with metadata

AI-generated images without metadata

Real images with metadata

Real images without metadata

Developer Exposure Is Global and Structural

Prompt Injection Exploits the Code and Data Collapse

Prompt-Attack Testing Exposes Open-Weight Risk

Partial Guardrails Still Leave Exploitable Gaps

Models may handle direct harmful requests while still failing in other ways, such as accepting false premises or mishandling deceptive context. For enterprise use, reliability matters beyond refusal behavior.

Direct Safety Training Does Not Cover Every Failure Mode

Models may handle direct harmful requests while still failing in other ways, such as accepting false premises or mishandling deceptive context.

For enterprise use, reliability matters beyond refusal behavior. A model that confidently accepts bad assumptions can pass risk into summaries, classifications, and decisions.

36 · Direct Safety Training Does Not Cover Every Failure Mode

Cost Exhaustion Targets AI Operating Cost

AI Agents Can Develop Offensive Behaviors

AI-powered botnet panels are beginning to expose natural-language control over distributed systems. An operator can describe a task, delegate it to agents across multiple servers, and monitor aggregated results from one interface.

Botnet Control Moves Toward Natural Language

AI-powered botnet panels are beginning to expose natural-language control over distributed systems.

An operator can describe a task, delegate it to agents across multiple servers, and monitor aggregated results from one interface. Manual control gives way to task-level orchestration.

39 · Botnet Control Moves Toward Natural Language

Different actor groups benefit from AI in different ways. State-affiliated actors gain from private models and lack of oversight.

Actor-Based Assessments

Different actor groups benefit from AI in different ways. State-affiliated actors gain from private models and lack of oversight. Financially motivated actors gain from deepfakes, automation, and credential access. Ideological groups gain from synthetic media and low-cost amplification.

The widest immediate risk may come from ordinary adoption outpacing governance, especially where employees connect AI tools to sensitive data without clear controls.

41 · Actor-Based Assessments

The next phase will bring more agentic systems, shorter exploitation windows after model releases, easier deepfake production, and more targeting of the AI supply chain. API keys, model weights, chat histories, plugins, extensions, and orchestration layers will remain high-value targets as enterprise AI adoption deepens.

Future Trajectory

The next phase will bring more agentic systems, shorter exploitation windows after model releases, easier deepfake production, and more targeting of the AI supply chain.

API keys, model weights, chat histories, plugins, extensions, and orchestration layers will remain high-value targets as enterprise AI adoption deepens.

42 · Future Trajectory

Windows 10 and Windows 11 dominate infected machines tied to AI credential exposure, while every other operating system sits below 2%. This points to a practical exposure pattern.

Windows Dominates Developer Stealer Infections

Windows 10 and Windows 11 dominate infected machines tied to AI credential exposure, while every other operating system sits below 2%.

This points to a practical exposure pattern. Many developers and AI users still work from standard personal or lightly managed machines where browser-stored credentials, cookies, saved passwords, and active sessions are easier targets for commodity stealers.

The risk is not limited to personal accounts. Developer browsers often hold access to repositories, model platforms, cloud consoles, internal dashboards, collaboration tools, and productivity services. Once stolen, those sessions can connect an infected endpoint to wider enterprise exposure.

For defenders, endpoint hygiene becomes AI security. Protecting model access, API keys, and developer identities requires controls on the machines where those credentials are actually used.

40 · Windows Dominates Developer Stealer Infections

Quarterly stealer log volume can swing sharply because of law enforcement actions, new malware releases, takedowns, redistribution of old logs, and bulk dumps entering the market. Short-term movement does not reduce the larger issue.

Stealer Log Volumes Shift Across Quarters

Quarterly stealer log volume can swing sharply because of law enforcement actions, new malware releases, takedowns, redistribution of old logs, and bulk dumps entering the market.

Short-term movement does not reduce the larger issue. The cumulative pool of exposed AI credentials keeps growing even when quarterly numbers fluctuate. Once credentials enter log markets, they can be resold, enriched, combined with other leaks, and reused long after the original infection event.

This makes exposure difficult to measure through a single snapshot. A temporary drop in newly observed logs does not mean the risk has disappeared. Old records can still be valid, and attackers can use them for account takeover, service abuse, prompt history access, or lateral movement into connected platforms.

The trend matters more than the quarter. AI credentials are becoming part of the stolen data economy, and their value depends on what they unlock downstream.

41 · Stealer Log Volumes Shift Across Quarters

Stealer log victim distribution reflects the global nature of AI development. Countries with large developer populations, active startup ecosystems, outsourced engineering teams, and uneven endpoint security baselines appear prominently.

Developer Exposure Is Global and Structural

Stealer log victim distribution reflects the global nature of AI development. Countries with large developer populations, active startup ecosystems, outsourced engineering teams, and uneven endpoint security baselines appear prominently.

The attacker does not need to know they compromised a developer. The stealer collects everything, and AI credentials are sorted, packaged, and monetized downstream. That creates risk even when the initial infection looks like ordinary commodity malware activity.

This makes developer identity exposure difficult to treat as a narrow endpoint problem. The same infection can reveal source-code access, private prompts, SaaS sessions, AI service credentials, internal collaboration tools, and cloud resources.

The exposure is structural because developer work is highly connected. One compromised machine can sit at the intersection of code, infrastructure, AI tooling, and business data.

42 · Developer Exposure Is Global and Structural

LLMs process instructions and external content as tokens inside the same context window. That collapses the traditional boundary between code and data.

Prompt Injection Turns Content Into a Control Surface

LLMs process instructions and external content as tokens inside the same context window. That collapses the traditional boundary between code and data.

When models connect to documents, emails, webpages, resumes, tickets, repositories, or tool responses, untrusted content can become part of the instruction environment. A malicious instruction does not need to arrive through a prompt box. It can be hidden inside content the model is expected to summarize, classify, retrieve, or act on.

This changes the attack surface for AI-enabled workflows. A document, ticket, webpage, or message can become a control surface when an AI system is allowed to read it and then call tools, write output, update records, or influence decisions.

The security boundary is no longer only the application interface. It also includes every content source the model can ingest and every action the model can trigger after reading that content.

43 · Prompt Injection Turns Content Into a Control Surface

Prompt-Attack Testing Exposes Open-Weight Risk

Key Findings

Prompt-attack testing against lightweight open-weight models shows elevated risk across several jailbreak and injection categories.

Reasoning models create a financial attack surface. An attacker may not need to steal data, bypass authentication, or force a wrong answer.

Cost Exhaustion Targets AI Operating Cost

Reasoning models create a financial attack surface. An attacker may not need to steal data, bypass authentication, or force a wrong answer. They may only need to make the system spend excessive tokens, time, and compute.

Agentic workflows increase this risk because one input can trigger retrieval, tool calls, retries, file reads, memory updates, and downstream actions. A carefully designed request can turn a single interaction into a long and expensive chain of operations.

This expands denial-of-service thinking beyond infrastructure. The target can be the budget, the queue, the model runtime, the rate limit, or the operational process attached to AI decision-making.

Inference cost should be monitored as a security signal. Sudden spikes in token usage, repeated failed tool calls, abnormal prompt length, or unusual reasoning depth may indicate abuse, not just heavy usage.

48 · Cost Exhaustion Targets AI Operating Cost

Agentic AI systems can create unexpected behavior when broad goals, tool access, memory, and environmental cues interact badly. The issue is not only malicious prompts.

Agentic Systems Create New Behavior Risks

Agentic AI systems can create unexpected behavior when broad goals, tool access, memory, and environmental cues interact badly.

The issue is not only malicious prompts. A system that can retrieve data, call tools, write files, coordinate with other agents, and update workflows can create risk through poorly bounded autonomy. Even a benign instruction can become risky if the agent has too much authority or too little context.

Security teams need to understand what the agent can see, what it can change, which tools it can call, and how failures are contained when the system follows the wrong instruction. Traditional application security controls may not cover the full behavior path once an agent starts making intermediate decisions.

The key question is scope. An agent’s risk depends on its permissions, memory, tool access, data sources, and the safeguards that stop a bad action from becoming a real-world change.

49 · Agentic Systems Create New Behavior Risks

Security Implications for Leaders

Key Findings

AI-powered vishing, high-capability LLMs, prompt injection, developer credential exposure, and cost exhaustion each create a different leadership problem.

AI changes cyber risk by removing bottlenecks. Social engineering scales without skilled callers, credential theft reaches deeper into developer workflows, prompt injection turns connected AI features into entry points, and cost exhaustion exploits pricing models that were not designed for adversarial use.

Conclusion

AI changes cyber risk by removing bottlenecks. Social engineering scales without skilled callers, credential theft reaches deeper into developer workflows, prompt injection turns connected AI features into entry points, and cost exhaustion exploits pricing models that were not designed for adversarial use.

The most serious risk is not noisy criminal tools that overpromise. It is capable actors using ordinary AI systems to accelerate real operations. AI can shorten preparation time, reduce the need for specialist skills, automate support functions, and make existing attack methods easier to repeat.

Defenders need to identify which capability is in play, where it fits in the attack lifecycle, and which controls still matter. The practical focus should be on exposure, access, workflow boundaries, and the points where AI removes time, skill, or cost barriers for attackers.

The strategic lesson is that AI risk is operational. Security teams should not only ask whether AI generated the content, code, or voice. They should ask which part of the attacker’s workflow became faster, cheaper, or easier because AI was involved.

54 · Conclusion