Microsoft Warns Cybercriminals Are Using AI to Automate Phishing and Malware Attacks

Security researchers are warning that cybercriminals are increasingly using artificial intelligence (AI) tools to automate phishing campaigns, develop malware and accelerate other stages of the cyberattack lifecycle.

New research from Microsoft reveals that threat actors have begun integrating AI into their workflows to increase the speed, scale and effectiveness of malicious cyber operations.

AI Is Reshaping the Cybercrime Landscape

According to Microsoft’s security blog, cybercriminal groups are adopting operational strategies similar to legitimate businesses. This includes structured organizations, specialization and “as-a-service” models. Now, these groups are also incorporating AI into their operations to increase efficiency and resilience.

Microsoft’s threat intelligence unit noted that most current malicious AI use focuses on language models capable of generating text, code and media. Threat actors are leveraging generative AI to:

• Draft phishing emails and social engineering messages
• Translate content into multiple languages
• Summarize stolen data
• Generate or debug malware code
• Build scripts and technical infrastructure

Ensar Seker, chief information security officer (CISO) at threat intelligence company SOCRadar, explained that attackers are mainly using existing AI tools rather than building their own advanced models.

“AI is rapidly becoming embedded across the entire cyberattack lifecycle, but not always in the ways people expect,” Seker said.

He added that AI currently functions more as a productivity tool for cybercriminals rather than a completely new attack method.

“The biggest impact of AI in cyber operations is efficiency rather than completely new attack techniques,” he said.

However, Seker emphasized that AI does not replace traditional attacker expertise. Sophisticated cyber campaigns particularly those run by nation-state groups still require manual reconnaissance, specialized tools and operational discipline.

“AI is acting more as a force multiplier than a replacement for established tactics,” he explained.

AI Speeds Up Cyberattack Preparation

Experts say AI is dramatically reducing the time attackers need to prepare cyberattacks.

Stu Bradley, senior vice president for risk, fraud and compliance solutions at analytics company SAS, noted that criminals previously spent weeks researching targets and crafting convincing scam messages.

With AI tools, those tasks can now be completed within seconds.

“GenAI enables fraudsters to produce polished, targeted content in seconds content that previously would have taken hours to craft,” Bradley said.

This automation also allows criminals to launch attacks against many more victims simultaneously, dramatically increasing their chances of success.

Cybersecurity strategist Eric Schwake from API security company Salt Security explained that AI can automate many stages of the cyber kill chain.

Threat actors can now use generative AI to:

• Conduct reconnaissance
• Write and debug malicious code
• Generate personalized phishing campaigns

“By reducing the time needed to develop and deploy an exploit, adversaries can strike faster than traditional security measures or human analysts can respond,” Schwake said.

AI as a Cybercrime Force Multiplier

Microsoft researchers also observed that attackers frequently use AI in operational tasks that indirectly support their campaigns.

Jacob Krell, senior director for secure AI solutions and cybersecurity at Suzu Labs, explained that AI allows cybercriminals to run multiple stages of an attack simultaneously.

Tasks such as:

• Reconnaissance
• Persona development
• Phishing lure generation
• Infrastructure setup
• Data analysis after breaches

can now occur in parallel across many targets.

“What previously required multiple specialists can now be compressed into a repeatable workflow,” Krell said.

Bradley added that AI helps criminal organizations operate large-scale operations with fewer people.

“You no longer need a large crew to run a large operation,” he said.

Automation also enables attackers to flood email, SMS, voice and social media platforms with personalized scam messages that appear far more convincing than previous phishing attempts.

Schwake noted that AI can enable even inexperienced attackers to conduct sophisticated campaigns.

“AI functions as a powerful force multiplier, enabling a single attacker to coordinate thousands of simultaneous intrusions,” he said.

AI Helps Attackers Rebuild Infrastructure Faster

Microsoft also warned that cybercriminals are using AI to develop and maintain their attack infrastructure.

AI models help attackers design, configure and troubleshoot covert infrastructure more quickly. This lowers the technical barrier for less experienced criminals and accelerates deployment while reducing detection risks.

Vincenzo Iozzo, CEO and co-founder of identity threat detection company SlashID, said AI could also enable more adaptive malware.

“AI-generated malware can be polymorphic, rewriting its own code to evade signature-based detection,” Iozzo explained.

Attackers can also quickly regenerate malicious payloads, rotate infrastructure and modify phishing tactics whenever security systems detect their activities.

Krell added that AI significantly shortens the recovery cycle for cybercriminal operations.

“When a payload, lure, or infrastructure component is detected, threat actors can use AI to rapidly rework code, refresh phishing content and reimplement functionality,” he said.

The Rise of Agentic AI in Cybercrime

While generative AI currently dominates cybercriminal usage, Microsoft researchers are beginning to observe early signs of agentic AI adoption.

Agentic AI refers to AI systems capable of performing tasks autonomously while adapting and learning over time.

For cybercriminals, this could enable semi-autonomous systems that:

• Continuously refine phishing campaigns
• Test and adapt attack infrastructure
• Maintain long-term system access
• Monitor open-source intelligence for new opportunities

Microsoft said it has not yet observed widespread use of agentic AI in cybercrime due to reliability limitations and operational risks.

However, early experiments suggest the technology could eventually automate tasks such as reconnaissance, infrastructure management, malware development and decision-making after breaches.

Krell said researchers have already seen early experiments involving agentic AI.

“Agentic AI is being used to support workflows that involve planning, tool use evaluation and adaptation over time rather than one-off prompting,” he said.

Microsoft has also reported that a North Korean threat group known as Coral Sleet has experimented with agentic AI tools to assist with phishing lures, infrastructure provisioning and rapid malware testing.

AI Is Making Cybercriminals More Efficient

Experts emphasize that AI is not replacing cybercriminals but enhancing their capabilities.

“AI is not replacing threat actors. It is making them more efficient,” Krell said.

The immediate impact of AI in cybercrime is not fully autonomous attacks but faster research, quicker adaptation and more scalable social engineering campaigns.

Krell warned that organizations that still treat cyber threats primarily as phishing problems may underestimate the broader operational shift underway.

“AI acceleration does not follow a linear path. Capabilities compound,” he said.