Cybercriminals are using artificial intelligence (AI) to produce malware, according to recent research conducted by HP.
HP’s latest Threat Insights Report reveals how attackers leverage generative AI to assist in crafting malicious code and highlight instances of cybercriminals embedding harmful code within images.
The report indicates that hackers carry out sophisticated “malvertising” campaigns, luring victims to well-designed websites that offer seemingly legitimate tools, such as PDF readers and converters.
These functional applications conceal malicious code, while genuine code-signing certificates enable them to bypass Windows security measures and user alerts, increasing the chances of infection.
The attack exposes users to infostealer malware, which can record their screens and log their keystrokes.
Patrick Schläpfer, Principal Threat Researcher in the HP Security Lab, added:
“Speculation about AI being used by attackers is rife, but evidence has been scarce, so this finding is significant. Typically, attackers like to obscure their intentions to avoid revealing their methods, so this behavior indicates an AI assistant was used to help write their code. Such capabilities further lower the barrier to entry for threat actors, allowing novices without coding skills to write scripts, develop infection chains, and launch more damaging attacks.”
Dr. Ian Pratt, Global Head of Security for Personal Systems at HP Inc., added:
“Threat actors are constantly updating their methods, whether it’s using AI to enhance attacks, or creating functioning-but-malicious tools to bypass detection. So, businesses must build resilience, closing off as many common attack routes possible. Adopting a defense-in-depth strategy — including isolating high-risk activities like opening email attachments or web downloads — helps to minimize the attack surface and neutralize the risk of infection.”
You can find more insights in the report.