How Artificial Intelligence Is Reshaping Cyber Risk

AI Intelligence · 2025

AI Threat Landscape: How Artificial Intelligence Is Reshaping Cyber Risk

Dark Web monitoring, capability testing of criminal AI tools, stealer log analysis covering over 3.1 million credential records, and red-team assessments — a comprehensive view of offensive AI in 2025.

AI Credentials Exposed

3.1M+

Vishing Surge Q1 2025

1,600%

AI Phishing Click Rate

54%

Credentials by 3 Malware Families

86%

OpenAI Credential Records

3.1M+

Over 3.1 million credential records tied to OpenAI alone were found in stealer log datasets — harvested not through targeted campaigns but as incidental catch from commodity malware.

AI Phishing Click-Through Rate

54%

AI-automated phishing emails achieved 54% click-through rates compared to 12% for standard attempts — a 4.5x increase — according to Microsoft research cited in Dark Web tooling discussions.

Vishing Surge Q1 2025

1,600%

Deepfake-enabled vishing surged by over 1,600% in Q1 2025, with attackers leveraging voice cloning to bypass authentication systems and manipulate employees into credential disclosure.

Exposure by 3 Malware Families

86%

Three malware families account for 86% of AI platform credential exposure — underscoring how commodity infostealers, not sophisticated targeted attacks, drive AI identity compromise at scale.

By the Numbers

Key Findings at a Glance

Data derived from SOCRadar's analysis of Dark Web forums, stealer log datasets, red-team assessments, and documented AI-enabled incident reviews.

AI's impact on cyber threats is driven less by capability breakthroughs than by structural changes to who can conduct attacks, at what speed, and at what scale.

AI's Impact Is Structural,

Not Just Technical

This report examines how artificial intelligence is reshaping the cyber threat landscape, drawing on Dark Web monitoring, capability testing of criminal AI tools, stealer log analysis covering over 3.1 million credential records, red-team assessments of open-weight models, and a review of documented incidents.

The central finding is that AI's impact on cyber threats is driven less by capability breakthroughs than by structural changes to who can conduct attacks, at what speed, and at what scale. The technology is compressing the time, expertise, and infrastructure previously required to execute offensive operations, while introducing new risk categories that existing security architectures were not built to handle.

The underground ecosystem is becoming faster, more consolidated, and increasingly self-improving. Criminal operations that once relied on scarce human expertise are now transitioning to a model based on scalable, automated, and professionally supported AI tools. SOCRadar · AI Threat Landscape Report 2025

01 · Executive Summary

Artificial intelligence has evolved from a novelty into a foundational operational layer within Dark Web ecosystems — a systematic integration spanning every phase of the attack chain.

Industrialization of

AI-Powered Cybercrime

The primary structural trend in the Dark Web is the industrialization of AI-powered attack capabilities through the Crime-as-a-Service (CaaS) model. Instead of individual actors developing bespoke tools, AI is increasingly integrated into service offerings that abstract technical complexity away from the buyer. This creates a dual impact: non-technical actors gain access to capabilities that previously required deep expertise, while technical actors can significantly accelerate and scale their existing operations. While underground AI usage was once defined by the repurposing of publicly available tools, the trend is shifting toward purpose-built, AI-native criminal services.

Highly targeted and personalized lures at scale, which previously required specialist knowledge, are now accessible through simple menu-driven services. Experienced operators use AI to compress timelines across the reconnaissance, development, and execution phases.

Multiple tools and attack stages are being consolidated into single AI-powered panels with API access and subscription tiers. AI is now embedded into offerings for phishing, vishing, fraud, malware generation, and reconnaissance — increasing the potential data value extracted per target.

Some threat actors explicitly advertise their services as "AI-free." By positioning the absence of AI as a trust or reliability differentiator, they suggest that AI has become the assumed baseline rather than a distinguishing feature — confirming the depth of AI's integration into the criminal ecosystem.

02 · AI Trends in the Dark Web Ecosystem

PlugValley

SIVIR AI Mailer

JINKUSU CAM

WormGPT

Carding Genie

The current environment does not necessarily grant attackers an absolute advantage — but it has fundamentally changed the nature of the contest. Speed, consolidation, and self-improvement now define the underground ecosystem.

The Contest Has

Fundamentally Changed

AI tools are significantly lowering the barrier to entry for complex cybercrimes. Tasks that previously required specialized coding knowledge, multilingual fluency, or extensive infrastructure setup are now available as automated services. This allows actors to execute operations in minutes that once took weeks — making smaller or previously unprofitable targets viable for exploitation.

Threat actors use AI to specifically counter improvements in security technology. As defenders implement better filters and behavioral analytics, underground developers release corresponding AI-driven updates to bypass these hurdles. The development cycle for bypass tools has accelerated to match the pace of legitimate software updates — eliminating the traditional lag defenders relied on.

AI-integrated criminal platforms function as organized service providers — offering tiered subscriptions, dedicated customer support, and distinct product branding. This establishes a consistent supply chain for entry-level actors while centralizing advanced technical expertise within specialized groups. The underground is beginning to look less like a bazaar and more like a structured SaaS ecosystem.

Criminal communities are actively debating the limits of AI autonomy. Currently, many threat actors prefer to maintain human oversight for tasks requiring nuanced judgment or behavioral consistency. But the direction of travel is clear: as AI improves, the scope of autonomous operation expands and the human oversight threshold rises — moving toward a model where the human is the exception, not the rule.

03 · Future Trajectory of AI-Enabled Threats

PlugValley

SIVIR AI Mailer

JINKUSU CAM

WormGPT

Carding Genie

Conclusion

Not Replaces

The primary risk is not AI-native novel attacks but AI enabling existing criminal tradecraft at unprecedented scale and speed. Focus defensive investments on the operational impact, not the technology label.

Attacker Population

The skill floor for conducting meaningful offensive operations has dropped dramatically. Organizations that previously faced primarily sophisticated threats must now defend against a much larger and more diverse attacker population.

AI Defensively

The same capabilities available to attackers are available for defense — threat intelligence automation, behavioral analysis, and pattern recognition at scale. Organizations not using AI defensively are conceding a structural advantage to adversaries who are.

10 · The Intelligence Imperative

Across all three lines of inquiry — underground AI economy, developer ecosystem exposure, and adversarial AI threats — the intent is the same: replace generalized anxiety with specific, evidence-based understanding.

Key Research Findings

SOCRadar AI Threat Intelligence Summary

Selected findings from SOCRadar's AI Threat Landscape research — covering capability testing, Dark Web monitoring, stealer log analysis, and documented incidents with direct security implications.

test 3

Test title

Test

Test 2

Test 3

Threat

Threat 2

PlugValley Content

Test

Test 2

Test 3

1187

Test

Test 1

Test

PlugValley

Key Research Findings

Data derived from SOCRadar's analysis of Dark Web forums, stealer log datasets, red-team assessments, and documented AI-enabled incident reviews.

A documented PlugValley session log shows credentials captured in 56 seconds total interaction time — from call answered to code captured. The human operator never spoke. The bot managed OTP collection, script navigation, and credential delivery autonomously.

Key Research Findings

Data derived from SOCRadar's analysis of Dark Web forums, stealer log datasets, red-team assessments, and documented AI-enabled incident reviews.

Key Research Findings