Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Adversaries are using AI to improve familiar tactics: writing and tailoring phishing messages, impersonating people with synthetic audio or video, producing influence content, and analyzing large datasets. Government assessments and threat-intelligence reports document these uses, but they do not show that fully autonomous hacking is routine. The evidence is a mix of reported incidents, assessments, and forecasts, each with limits on date and visibility.
What adversaries are using AI to do
AI can help with several stages of an operation, from preparing content to analyzing information. It is best understood as an aid to existing workflows—not proof that an attacker can simply hand a system a target and have it conduct a complete operation on its own.
Make social engineering more convincing
Canada’s National Cyber Threat Assessment 2025–2026 says cybercriminals and state-sponsored actors are using generative and predictive AI in their workflows, including for content generation and big-data analysis. The Canadian Centre for Cyber Security assesses that large language models are being used to improve social engineering, create personalized phishing, and imitate trusted people with synthetic audio or video. It describes the intended outcomes: persuading someone to disclose sensitive information, approve a fraudulent transaction, or download malware. These are Canadian government assessments, not a count of incidents worldwide. Read the assessment.
Analyze large amounts of information
The same Canadian assessment says well-resourced state actors use AI-enabled analysis to process bulk data, find patterns, and inform follow-on cyber operations. That describes a capability and reported use; the assessment does not quantify how often it happens. Analysis can support an operation without AI carrying out the intrusion itself.
Produce influence material across media
AI-generated text, images, audio, and video can be used to add material to an influence campaign or make it appear more polished. Canada’s assessment says countries including China, Russia, Iran, and Israel have reportedly incorporated deceptive AI-generated articles, images, and videos into influence operations, and that they likely use AI to create fictitious social-media bots and online personas. It describes campaign aims as polluting the information space, weakening trust, and sowing doubt and division. The language matters: these are the Canadian Centre’s assessments, including its use of “reportedly” and “likely,” rather than proof that every campaign by those countries uses AI.
#1 Best Overall
What reported examples show—and what they do not
Microsoft’s 2024 Digital Defense Report describes examples it attributed to state-linked influence activity. They illustrate how AI-generated or enhanced media may fit into campaigns, but the attributions and confidence levels belong to Microsoft’s reporting rather than constituting a neutral, complete record of all activity.
- Microsoft attributed an AI-generated cartoon circulated in May 2024 to China.
- It attributed June 2024 AI-generated audio of Elon Musk narrating a fabricated documentary to Russia.
- It described a video circulated ahead of an Iranian military operation as likely AI-generated.
Microsoft said Russia, Iran, China, and other nation states were incorporating AI-generated or enhanced content into influence operations. Its examples show reported uses of synthetic or edited material; they do not establish how persuasive the content was, how many people it reached, or whether it changed anyone’s behavior. See Microsoft’s 2024 report.
How AI fits into a broader operation
Microsoft’s 2025 Digital Defense Report describes activity that goes beyond generating a single message or image. It identifies “AI twinning”—creating digital replicas of trusted news anchors—alongside training-data poisoning and voice cloning or masking. The report also describes AI being combined with conventional methods such as phishing, credential harvesting, and insider recruitment. Microsoft’s analysis is that these combinations can make operations easier to scale, more effective, and harder to trace; this is a vendor’s account of observed trends and strategic implications, not a global prevalence measure. Read the 2025 report.
“AI twinning” and synthetic voice can complicate judgments about whether a familiar person or source is genuine. Training-data poisoning targets what an AI system learns from, rather than just the content it produces. These tactics point to a broader concern: operations may seek to manipulate both people consuming information and systems that generate or process it.
Rank #3
Does AI make cyberattacks easier to scale?
It can lower effort or help tailor content, but the available sources do not establish one universal increase in attack success or scale. Canada’s Cyber Centre assesses that AI is almost certainly lowering barriers to entry and enhancing the quality, scale, and precision of malicious cyber activity. Separately, a 2026 U.S. Government Accountability Office spotlight relays an academic study’s estimate that generative AI could reduce malicious users’ phishing-attack costs by more than 95 percent. GAO’s page does not identify the study’s methods, so the figure should be read as a reported estimate—not a measured real-world cost reduction that applies to every attacker or campaign. See the GAO spotlight.
The maturity of use is also important. CrowdStrike’s 2025 Threat Hunting Report characterizes much adversarial use of generative AI as iterative and experimental, while discussing examples in influence and cyber operations. That finding reflects CrowdStrike’s own threat visibility and analytic framework, not a census of global activity. It supports a measured conclusion: AI is already being tried and used to assist operations, while claims of routine, independent AI-run attacks go beyond what these reports establish. Read CrowdStrike’s report.
Why older forecasts should not be mistaken for current facts
Some widely cited assessments were forecasts with specific end dates. The UK Department for Science, Innovation and Technology’s 2023 assessment said: “Over the next 18 months, generative AI (artificial intelligence) is more likely to amplify existing risks than create new ones.” That was a publication-era outlook through 2025, not a prediction newly issued for 2026. The assessment excluded military risks. It also judged that fully automating computer hacking was unlikely by 2025 and that criminals were less likely to create novel malware successfully with generative AI by then. Those statements remain useful context for understanding what the UK government expected at the time, but they should not be presented as measurements of present-day activity. Read the UK assessment.
Likewise, the U.S. Department of Homeland Security’s 2025 Homeland Threat Assessment was published on September 30, 2024. Its statement about continued malicious use of generative AI for cyber activity and malign influence was an expectation for 2025, including the prospect of lower technical barriers and greater personalization and scale—not a retrospective tally of what happened that year. Read the DHS assessment.
Best Value
What organizations can do in response
No single detector or training session can address every use of AI. The sources point toward layered defenses: reduce the chance that an impersonation or phishing attempt succeeds, protect the systems and information attackers may target, and make it easier to verify and report suspicious activity.
- Verify unusual requests through a separate channel. For payment changes, credential requests, or urgent instructions, contact the supposed sender using a known number or established internal process rather than relying on the message, voice, or video that delivered the request.
- Maintain layered cyber defenses. Use established protections for accounts, devices, and sensitive information, and ensure staff know how to report suspicious messages or suspected impersonation.
- Assess AI systems as part of the attack surface. Consider whether inputs, training data, outputs, or connected accounts could be manipulated, and review controls as systems and threats change.
- Use safeguards as layers, not guarantees. GAO notes that NIST has identified approaches including reinforcement of safeguards through human feedback, filtering user instructions, and using separate generative AI technology to detect malicious attacks. GAO also notes that manipulation techniques evolve, so safeguards require continuing security work. GAO’s spotlight discusses these mitigations.
- Authenticate important information before sharing it. When a claim or recording could cause harm, check for confirmation from a reliable source and consider whether the material’s origin can be verified. Synthetic media can be one part of an influence effort, but the cited reports do not establish a universal method for detecting it.
The practical risk is not that every AI-generated message is convincing or that every cyber operation is automated. It is that AI can help adversaries produce, tailor, analyze, or disguise material within familiar operations, while the evidence about particular incidents and their impact remains source-specific.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
