AI in Malware: How Attackers Use LLMs for Cyberattacks — and What It Really Means

AI is changing the cybersecurity landscape — that’s not an exaggeration, but it’s not an apocalypse either. While media reports like to talk about “AI-controlled super viruses” that autonomously penetrate corporate networks, the reality is more sober. Researchers at Palo Alto Networks Unit 42 have systematically analyzed how attackers actually use large language models today. The result: There are real risks, a lot of marketing — and a clear gap between what’s possible and what’s already observed in the wild. This article explains what the term “AI malware” means, which scenarios are real today and what companies should derive from it.

What makes AI really attractive to attackers

The key question is not whether AI enables attacks that were previously impossible — but whether it makes attacks easier, faster or more scalable. And here the answer is: yes, clearly in certain areas.

Large language models like GPT-4 or similar systems can write, explain and debug code. This is useful for developers — and also for attackers who don’t have a deep technical background. Anyone who previously needed programming knowledge to write a functional keylogger or a simple infostealer can now consult an LLM for the right question. The barrier to entry is lowering.

Added to this is scaling. AI makes it possible to no longer send phishing messages as generic mass emails, but rather to generate linguistically flawless texts that are individually tailored to the target. An email in the name of your superior, with reference to a specific project, in perfect Swiss German — that used to be time-consuming. Today it’s a prompt.

The IBM X-Force Threat Intelligence Index 2026 shows how real this pressure already is: Active ransomware groups increased by 49 percent compared to the previous year. Usage of publicly accessible systems increased by 44 percent. And more than 300,000 stolen credentials for AI chatbot services appeared on dark web marketplaces — an indication that attackers are actively seeking access to AI tools. 56 percent of the disclosed vulnerabilities did not require authentication, which makes it even easier for less experienced actors to get started.

The three usage scenarios: AI-written malware, AI as C2 operator, AI agent attacks

Unit 42 has identified three fundamental categories in which AI can play a role in the context of malware and cyberattacks. These categories help to structure the discourse – because they differ significantly in their level of maturity and actual threat level.

Category 1: AI writes malware. This is the best known and most widespread category. Attackers use LLMs to generate and optimize malicious code or create hard-to-detect variants of existing malware. It’s less about novel, revolutionary attack methods and more about efficiency: code that used to take hours of development time is created in minutes. Security-relevant functions such as obfuscation – the obfuscation of code – can be automated using AI. Underground models like WormGPT or FraudGPT, which have been known since 2023, go even further: They were explicitly trained without security restrictions and offer a kind of “malware-as-a-service” infrastructure for less technically sophisticated criminals.

Category 2: AI as a remote C2 decision maker. In this scenario, the AI ​​is not the author of the malware, but rather its conductor. The command and control system (C2), through which attackers control infected systems, obtains decisions from an LLM. The malware sends information about the target environment to a language model and receives instructions back: Which files should be exfiltrated? Which next steps make sense? This scenario has already been observed in real-world malware — although with mixed results as to its actual usefulness.

Category 3: Local AI-powered attack agents. This is the most technically advanced scenario and one not yet observed in the wild. Here, an AI model would run directly on the compromised system and make decisions autonomously – without an external API connection, without a connection to the outside world. Such an agent could move laterally through a network, detecting and exploiting vulnerabilities, all without human control. Technically, this is still extremely complex today: powerful language models require significant computing resources that are not easily available on an average company endpoint. This scenario remains a thing of the future for the time being – but it would be negligent to lose sight of it.

Concrete examples from practice: AI Theater and AI-Gated Execution

In its analysis, Unit 42 documented two concrete patterns that exemplify the current state of affairs.

The researchers aptly call the first pattern “AI Theater”. This is a .NET-based infostealer — malware that steals access data and other sensitive information from the infected system. This info stealer calls the OpenAI services, specifically GPT 3.5 Turbo, via an HTTP API. Sounds like a sophisticated, AI-controlled attack — but it’s not really. In this specific case, the integration of AI does not bring any measurable tactical advantage. The Infostealer would work the same way without the LLM call. What’s left is a marketing stunt: The malware is marketed as “AI-powered”, which apparently works as a selling point in criminal underground forums. AI Theater – facade instead of substance.

The second pattern is technically much more interesting: “AI-Gated Execution”. This is a Golang-based malware dropper that uses an LLM not for code generation, but for decision making. Before the actual malware is installed, the dropper analyzes the target environment and sends the collected information to a language model. The LLM evaluates whether the system is a suitable target for attack – and only then gives the green light for the next stage. This is smarter: Malware that doesn’t install itself on unsuitable targets leaves fewer traces, is harder to detect and doesn’t waste resources. This pattern shows that AI can be used sensibly in an attack context – even if the implementation is still a long way from autonomous agent scenarios.

Both examples illustrate the spectrum: On the one hand, buzzword-driven functions without real added value. On the other hand, the first, quite clever uses of AI as a decision-making component in attack infrastructures.

The reality check: What is already happening today – and what is (still) hype

It is worth making a clear distinction between what is already proven to be happening today and what is a theoretical risk.

What is real today:
Phishing attacks are becoming massively more effective thanks to AI. Language barriers are eliminated, texts appear more authentic, and personalization is possible on a large scale. This is not a future scenario — this is happening now. Code generation for simpler malware is also realistic: jailbreaking prompts for ChatGPT and similar models are circulating in underground forums, and specialized models without security filters are available on the dark web. The number of active threat actors is increasing and access to attack tools is being democratized — with the direct help of AI.

AI-supported attacks on authentication systems are no longer just theory. CAPTCHA bypassing through AI-based image recognition can be practically automated for many classic CAPTCHA types. Deepfake-based attacks on video identification methods have already been documented.

What is (still) exaggerated:
Local, autonomously acting AI agents in malware do not yet exist in the wild. The technical hurdles — model size, computing power, storage requirements — are real. A language model that can make complex attack decisions may fit on removable storage devices, but its operational utility for complex autonomous attacks falls short of computational power and reliability. The idea that AI malware will completely replace classic attack vectors is also wrong: SQL injection, phishing and unpatched vulnerabilities still dominate the attack statistics. AI is an amplifier, not a paradigm shift.

And last but not least: Defenders also benefit. AI-powered anomaly detection, automated threat hunting and behavior-based analysis are now standard in professional security operations centers. The race between attackers and defenders remains a race of equals — AI accelerates both sides.

What companies and IT teams should do now

The finding that AI helps attackers sounds worrying. However, the practical consequences are less dramatic than often portrayed – and are largely a continuation of tried and tested security principles.

Strengthen phishing resilience. As AI makes phishing attacks more convincing, awareness training and technical protections must keep pace. Multi-factor authentication (MFA) is no longer a nice-to-have, but rather a minimum standard. Employee training should be updated regularly — generic “don’t click on links” training is no longer enough.

Take patch management seriously. According to IBM X-Force, 56 percent of exploited vulnerabilities did not require authentication. This means: Unpatched systems are the biggest gateway, long before sophisticated AI malware. Anyone who keeps their systems up to date closes a large part of the real attack surface.

Control AI access. The 300,000 stolen chatbot credentials on the dark web show that attackers are specifically looking for AI tool access – presumably to bypass security filters or to access sensitive data in corporate AI systems. Access controls for internal AI tools and regular checking of API keys are therefore important.

Use security AI. Anyone who only sees AI as a threat is wasting an opportunity. SIEM systems with AI-supported anomaly detection, automated vulnerability scanning and AI-based threat hunting are common in mature SOCs, but are by no means a given in medium-sized companies. They help manage the increasing attack load — especially for teams that are not adequately staffed 24/7.

Maintain realistic risk assessment. That sounds banal, but it isn’t. Resources are limited. Anyone who reacts to science fiction scenarios with local AI agents in malware while unpatched VPN gateways are in the network is setting the wrong priorities. Unit 42 explicitly emphasizes that many AI-in-malware claims are exaggerated. An objective risk analysis is the most important basis for sensible protective measures.

Conclusion

AI is changing the threat landscape — but not in the way Hollywood imagines. The reality is more prosaic and therefore more manageable: AI lowers the barrier to entry for less experienced attackers, makes phishing more convincing and enables the first intelligent decision-making components in attack tools. Autonomous AI agents that independently compromise networks have not yet been technically implemented. What counts today are classic security hygiene, stronger authentication and the targeted use of AI on the defense side. The biggest threat isn’t the AI ​​malware of the future — it’s the unpatched systems of today.