In addition to making one reminisce about Terminator movies, artificial intelligence is changing how people work, write, and communicate. But it is also changing how hackers attack. The same tools that help developers write code, marketers write copy and also help Hollywood fend off a strike by the Writers’ Guild are now part of cybercriminals’ toolkit.

Recently, we have had a first-hand experience of a slew of AI-designed phishing web sites that are completely (and I mean completely) undistinguishable from the originals. And that is just one example of advanced AI helping black hats become smarter, quicker, and highly automated.

Here are a few examples of how hackers are using AI right now, and what it means for your cybersecurity.

1. Automated and Hyper-Realistic Phishing

In the past, one could easily spot a phishing email. They were often riddled with bad grammar, strange fonts, and obvious spelling mistakes. AI has completely fixed that problem for scammers.

• Flawless Writing: Generative AI tools allow hackers to draft perfect, professional emails in any language.
• Mass Customization: Instead of sending one generic email to thousands of people, AI can scrape public social media profiles and crafts thousands of unique, highly targeted “spear-phishing” emails in seconds. (First-hand experience here!)
• Vishing and Deepfakes: Hackers use AI voice-cloning software to mimic company executives or family members. They call victims and trick them into transferring money or revealing passwords.

2. Smart Malware That Evades Detection

Traditional antivirus software works like a digital security guard looking for known criminals. It matches files against a database of known malware signatures. In 2026, this is no longer enough; AI allows hackers to defeat this entirely. Below are a couple of common strategies:

• Polymorphic Code: Cybercriminals can use AI to automatically rewrite a malware code every time it infects a new device. The core function remains, but the digital signature changes. This makes it very hard to detect for signature-based traditional antivirus scanners.
• Context-Aware Attacks: AI-driven malware can “sit and wait” inside a network. It studies user behavior, probes and explores, and launches the attack at the right moment.

3. High-Speed Vulnerability Hunting

Every piece of software (and hardware) has hidden bugs or vulnerabilities. Finding them used to require days or weeks of manual human labor.

• Instant Scanning: Hackers train AI models to scan large networks, applications, and source code for security flaws in seconds.
• Zero-Day Exploits: Because the AI finds these flaws so quickly, hackers can exploit them before the software developers even know the bug exists.

4. Bypassing Biometrics and CAPTCHAs

We rely on CAPTCHAs (“Click all bicycles”), MFA and biometric data to prove we are human and who we are. These tools are under increasing pressure these days.

• Solving Puzzles: Advanced machine learning models can solve complex visual and text CAPTCHAs with higher accuracy than humans.
• Face and Fingerprint Spoofing: While still complex, dark web is abuzz with AI-generated images and synthetic biometric data experiments, whose aim is to trick basic facial recognition login systems.

5. AI Hacking-In-Action: A Case Study

We recently had a close call when an attack on one of our client’s users used Microsoft 365’s DeviceCodeFlow vulnerability to defeat multifactor authentication protocol and hijack user’s M365 session. (DeviceCodeFlow process is normally used to sign into devices such as smart TVs and conference room systems, but has recently emerged as a favorite target of EvilTokens phishing-as-a-service AI toolkit.) The phishing site looked indistinguishable from the original, as is a new normal these days. Thankfully, client’s cybersecurity monitoring service—which makes extensive use of AI—notified the IT group of suspicious activity six minutes later, and the account in question was disabled and all its sessions disconnected two minutes thereafter. At that point compromise was contained. Subsequent investigation uncovered no emails sent from the M365 account in question, and no harvesting of user’s OneDrive files or M365 information was evident either. Finally, all user’s devices were investigated and given clean bill of health. In other words, event was contained before it was able to go beyond session hijacking.

The Silver Lining: Fighting AI with AI

If this sounds scary, it is. Bad news is that vulnerabilities that were once considered unexploitable (like DeviceCodeFlow) now are, and cost of entry for quite sophisticated cyber attacks is now quite low, thanks to AI.

Good news is that defense is evolving just as fast as the offense. Cybersecurity monitoring services now use using Defensive AI to monitor network traffic in real-time, and can spot the exact moment malware starts acting strangely and isolate it instantly. Cybersecurity has officially become an AI-versus-AI chess match. Personally, I sometimes feel like a human chess player watching a match between two chess engines.

To protect yourself, double-down on the basics: Multi-Factor Authentication (MFA) is still your friend, and real-time monitoring can justify its cost by preventing just one data breach. Also, multi-vendor defense in depth is still an effective strategy to deal with cyberthreats. (In the next few blog entries, I will outline details of such strategy.) Finally, can we please dispose of DeviceCodeFlow vulnerability?