Cybersecurity researchers have recently identified an email phishing campaign that deploys a malware dropper likely produced by a generative AI model. Cybercriminals have been known to use “Dark” AI to enhance their social engineering attacks, better articulating their pretext and eliminating tell-tale grammatical and spelling errors. CTIX analysts reported on the emergence of “Dark” AI this summer. Now it is evident that unsophisticated cybercriminals are leveraging generative AI tools trained for malicious intent to build malware, further lowering the barrier of entry into the cybercrime industry. Researchers at HP Wolf Security recently released their analysis of a phishing email with an invoice lure and encrypted HTML attachment. Once the HTML attachment is decrypted, a website opens and a VBScript runs that drops the AsyncRAT infostealer onto the victim machine. The VBScript writes various variables to the Windows Registry to establish persistence. A JavaScript file is also dropped into the user directory which is run by a scheduled task. The JavaScript executes a PowerShell script which makes use of the Registry variables and starts the malware payload after injecting it into a legitimate process. It is the VBScript and JavaScript files that researchers believe were likely created with the help of generative AI. For one, the scripts are very neatly structured with detailed and commented code. In addition, the scripts are written in French (which is not commonly the language used by malware architects). Sophisticated attackers do not comment their code, in fact they attempt to make their malware as difficult as possible to analyze through obfuscation and confusion. The infostealer payload, AsyncRAT, is a free and readily accessible malware that could be picked up and used by any novice cybercriminal. These circumstances reflect the high likelihood that the malware campaign was created by an unseasoned cybercriminal with the help of generative AI. CTIX analysts are keeping an eye out for any additional developments that would suggest generative AI is being used to generate malware payloads beyond just droppers. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.