Google's Threat Intelligence Group (GTIG) on Tuesday outlined significant trends in cybercrime, emphasizing artificial intelligence's dual role as a tool for attackers and a prime target. The most alarming revelation is the first documented case of a threat actor employing a zero-day exploit developed with AI assistance. Although Google thwarted the attack, this incident heightens worries about AI empowering cybercriminals.

Google Warns of AI's Growing Role in Real-World Cyberattacks

In a detailed blog post, Google's cybersecurity experts detailed how AI is fueling sophisticated cyberattacks. GTIG notes that adversaries have evolved beyond basic uses like crafting phishing emails, now leveraging generative AI for complex tasks such as vulnerability scanning, exploit crafting, malware engineering, and evasion techniques against defenses.

A standout discovery involves a coordinated campaign targeting a zero-day flaw - a previously unknown software vulnerability. GTIG detected a threat actor wielding an AI-assisted zero-day exploit. Google identified the issue preemptively, preventing widespread deployment, and collaborated with the vendor to deploy a fix.

The exploit struck a widely used open-source web management platform, enabling attackers to sidestep two-factor authentication (2FA), which typically demands an extra verification beyond passwords.

Clues in the exploit's code pointed to AI origins, including distinctive coding styles, instructional comments, and a mock vulnerability score formatted like those from large language models.

GTIG further highlighted AI's role in speeding up malware creation and enhancing efficiency. AI-aided programming allows threat actors to build flexible malware and obfuscation methods that dodge detection tools.

Google spotlighted malware strains like PROMPTSPY, an AI-powered variant that assesses system conditions and crafts responses on the fly. This adaptability lets it tailor actions to the specific infected environment.

The analysis also flags rising AI adoption among actors tied to China, North Korea, and Russia for vulnerability probing and attack orchestration. Some have harnessed AI to dissect public flaws, test exploit prototypes, and refine hostile networks.