iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
AI is making parts of cyberattacks faster and easier to adapt, but it has not replaced conventional cybercrime or made attacks automatically successful. Threat-intelligence reporting documents AI helping some attackers research targets, write more convincing phishing lures, develop malware, and explore vulnerabilities. Meanwhile, Microsoft’s 2025 report says established weaknesses and password attacks remain central in its observed data. The practical lesson: take AI-assisted scams seriously, but focus your defenses on the familiar ways attackers get in.
How are hackers using AI?
“AI-driven” can describe very different things: AI-generated text in a phishing message, an attacker using an AI tool during research, or malware that queries a model while it runs. Those are distinct capabilities, and evidence of one does not establish the others.
Google Threat Intelligence Group (GTIG) reported in November 2025 that it had observed threat actors using AI for research, phishing-lure creation, malware development, and other parts of an attack. Its examples included state-backed actors using AI across reconnaissance, phishing, command-and-control development, and data exfiltration. These are GTIG’s observations, not a count of all attacks or a measure of how common AI use is.
In February 2026, Google described AI being used for information gathering, realistic phishing scams, and malware development. The reports show AI serving as an operational aid: it can help with tasks inside an attack workflow, but it does not remove the need for access, infrastructure, or a successful path into a target.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Can AI create malware that changes while it runs?
GTIG’s November 5, 2025 report described malware families that use large language models during execution to dynamically generate or alter malicious behavior. GTIG characterized these capabilities as nascent. That is evidence of experimentation, not proof that adaptive AI malware is widespread or independently capable of carrying out complex attacks.
The same report discussed PROMPTFLUX and PROMPTSTEAL, as well as attempts to use prompts resembling social engineering to bypass model safeguards and an illicit market for AI tools. These examples illustrate attackers testing ways to apply AI; they do not show that ordinary malware has generally become autonomous.
In its May 12, 2026 report, GTIG also described autonomous behavior in PROMPTSPY, AI-supported defense evasion and malware, and targeting of software supply chains serving AI environments and their dependencies. These findings are the company’s threat-intelligence assessment, drawing on its research and incident-response work.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Are AI-assisted attacks finding new software flaws?
AI could help an attacker look for vulnerabilities or develop an exploit, but claims about a particular exploit need careful attribution. In May 2026, GTIG reported that it believed a threat actor had used AI to develop a zero-day exploit—a flaw exploited before a fix was available. GTIG said the actor planned mass exploitation and that its proactive discovery may have prevented it. The report describes GTIG’s assessment, not independently established proof that AI created the exploit or that mass exploitation occurred.
That concern sits alongside an older, more ordinary risk: attackers exploiting known security gaps. Microsoft’s Digital Defense Report 2025 describes attacks targeting known weaknesses, including web assets and remote services. Keeping software and internet-facing services patched remains relevant whether an attacker used AI or not.
Rank #2
- WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
- 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
- Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
- Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
- Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.
Are AI cyberattacks worse than regular cyberattacks?
AI can reduce effort or improve the quality of particular tasks, such as tailoring a lure or researching a target. That can make familiar attacks more efficient or convincing. It does not mean every attack is AI-enabled, novel, or more likely to succeed.
Microsoft reported that 97% of identity attacks in its observed data were password spray attacks. That figure is specific to Microsoft’s dataset and reporting; it is not a universal rate and says nothing about what share of attacks used AI. It does underline that attackers continue to rely on established ways of compromising accounts, not just new AI techniques.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Google’s February 2026 reporting also distinguished model-extraction attacks against private-sector entities from direct attacks on AI products: Google said it had not observed direct advanced persistent threat attacks on frontier models or generative AI products. Model extraction—attempting to reproduce or obtain information about a model—is not the same as an ordinary network intrusion.
No global prevalence figure or total count of AI-driven cyberattacks is established by these reports. The evidence supports a real but uneven shift in attacker tooling, not the conclusion that AI is behind most cybercrime.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can you protect yourself from AI phishing and account theft?
Do not rely on spotting awkward wording as your main defense. AI can help produce more fluent, personalized messages, but the basic checks still apply: verify unexpected requests through a separate, trusted channel, be wary of urgent demands to sign in or transfer money, and avoid opening unexpected attachments or following unfamiliar links. A familiar tone or accurate personal detail does not prove a message is genuine.
Rank #3
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
For account protection, prioritize multifactor authentication (MFA). CISA recommends MFA and favors phishing-resistant methods where available. A physical security key can resist credential phishing on compatible accounts and devices; CISA’s small-business guidance names YubiKey as an example. Check that the service supports the key and connector you have, and set up recovery options in case it is lost. A security key protects the sign-in step, not the device from malware or software exploits.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteIf a service does not support a security key, an authenticator app is an alternative MFA method described in CISA guidance. Choose a method the account supports and keep its recovery process accessible. MFA reduces the risk that a stolen password alone will be enough to sign in; it does not make an account invulnerable.
What should organizations prioritize?
AI changes some attacker workflows, but the reported activity does not make basic security controls obsolete. Organizations can reduce exposure by concentrating on the paths repeatedly used in conventional attacks:
- Patch known vulnerabilities, especially on internet-facing systems and remote services.
- Require MFA for accounts, favoring phishing-resistant authentication for sensitive access when compatible.
- Train staff to verify unusual payment, credential, or data requests using a separate channel rather than judging a message only by its wording.
- Review dependencies and software supply-chain exposure, including components used in AI environments.
These measures address established entry points and account risks. They are not guarantees against every attack, including those that use AI.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
