AI facilitation now extends into malware development and tool creation, with actors using Cursor AI for code generation and obfuscation, while the ARTEX open-source agentic AI framework has been employed in actual operations by Onyx Sleet and Pearl Sleet since late October 2026.

AI-assisted scaling and analysis help maintaining fraudulent personas, automating repetitive tasks, summarizing information from victim organizations, and supporting post-compromise decision making; late 2026 saw Onyx Sleet and Pearl Sleet leveraging ARTEX in operations.

AI-assisted software and tooling development shows actors using AI-enabled platforms to generate, debug, refactor code, support persistence and obfuscation, and enable rapid retooling, exemplified by Sapphire Sleet’s Rust/complete malware campaign and Coral Sleet’s trojanizing of private GitHub repos.

Defenders are urged to shift to AI-driven behavioral analysis, strengthen supply chain audits, improve employee security awareness, and enforce multi-factor authentication to prepare for intelligent cyber threats.

Attackers can generate hundreds of customized PDF phishing lures in minutes, using AI to craft realistic grammar and formatting that bypasses traditional defenses.

Three of eight groups are in operational stabilization for AI adoption, four are in acceleration, and one is in expansion; no group has achieved fully autonomous attacks without human input.

Jade Sleet used AI for fake recruitment and identity impersonation, targeting workers in AI, blockchain, cybersecurity, and recruitment fields through three front companies.

The article emphasizes that AI enables threat actors to speed and scale existing tradecraft rather than create autonomous operations, and outlines practical steps for defense.

Microsoft Threat Intelligence released a report showing eight North Korean hacker groups actively integrating AI into attack workflows, with three deeply AI-enabled during August to October 2026.

The same report notes eight North Korea–linked groups incorporating AI into attack processes in the late summer and fall of 2026.

Open-source AI models and edge inference are expected to raise threats to critical infrastructure and crypto-financial systems, expanding the attack surface and demanding rapid defense adaptations.

Threat actors use AI to scale reconnaissance, tailor lures and personas, and automate content generation, including job-themed social engineering and resume creation to improve credibility and reach.