A recent report by Microsoft Threat Intelligence highlights the increasing use of artificial intelligence (AI) by threat actors to enhance and scale cyberattacks. Attackers leverage generative AI tools for tasks like reconnaissance, phishing, infrastructure development, malware creation, and post-compromise activities. AI aids in drafting phishing emails, translating content, summarizing data, debugging malware, and configuring infrastructure, acting as a force multiplier that reduces technical barriers and accelerates attacks. Specific groups like North Korean actors Jasper Sleet and Coral Sleet use AI to develop realistic identities and resumes for gaining employment at Western companies, maintaining access post-hire. Jasper Sleet uses AI to create fraudulent digital personas, while Coral Sleet generates fake company sites and infrastructure. Threat actors also use AI for malware development, generating and refining malicious code, and employing AI-enabled malware that dynamically adjusts its behavior. Despite AI safeguards, actors use jailbreaking techniques to circumvent restrictions and generate malicious content. Microsoft notes that AI is currently used more for decision-making rather than autonomous attacks. CTIX Analysts advise organizations to treat these AI-driven schemes as insider risks and focus on detecting abnormal credential use, securing identity systems, and protecting AI systems. Microsoft’s observations align with reports from Google and Amazon, indicating a broader trend of AI being used to lower entry barriers for cybercriminals and enhance attack capabilities. Microsoft Defender detection rules for these activities can be found in the Microsoft report listed below.