AI-Powered Cyberattacks – How Hackers Use Machine Learning in 2026

In February 2026, a financial services firm in Singapore received a spoofed video call from what appeared to be their CFO, requesting an urgent wire transfer of $4.3 million to a new supplier account. The voice was indistinguishable from the real CFO. The face matched perfectly.

The finance team approved the transfer. The CFO had never made the call. The attacker had generated a real-time deepfake using publicly available video footage from a conference appearance and a voice cloning model trained on three minutes of audio from an earnings call. Total attack preparation time: under four hours.

This was not science fiction, and it was not an isolated case. 2026 represents an inflection point in the history of cyberattacks: artificial intelligence has removed the skill ceiling from offensive operations. Tasks that previously required months of reconnaissance, skilled social engineers, experienced malware developers, and coordinated criminal infrastructure can now be partially or fully automated using large language models, diffusion models, and reinforcement learning systems. The barrier to sophisticated attack has never been lower. The volume and personalisation of attacks have never been higher.

This guide explains precisely how threat actors are using machine learning and AI in 2026: the specific techniques, real documented case studies, the attack categories where AI provides the most significant advantage to attackers, and the defensive controls that security teams must implement to counter AI-assisted attacks. Understanding the technology being weaponised against you is the first step to defending against it.

To understand why AI represents a qualitative shift in the threat landscape rather than a quantitative one, it helps to understand what previously limited cyberattack effectiveness.

Historically, the most damaging attacks required rare, expensive human skills: a skilled social engineer who could convincingly impersonate someone in a phone call; a malware developer who could write code that evaded modern endpoint protection; a vulnerability researcher who could find and exploit a zero-day; an analyst who could spend weeks processing reconnaissance data to identify the highest-value targets. These skills were scarce, expensive, and did not scale.

AI does not replace those skills -- it democratises and scales them. An LLM can write a grammatically perfect, contextually accurate spear phishing email for any target given 10 minutes of LinkedIn research. A voice cloning model can replicate any person's voice from three seconds of audio.

A code generation model can produce functional malware with evasion techniques on request. A vulnerability analysis model can scan thousands of lines of code for exploitable patterns in seconds. None of these require the original rare human expertise -- they require a computer, an internet connection, and the knowledge to prompt the model correctly.

The three capabilities that have most fundamentally changed offensive operations are: language models that remove the skill and language barrier from social engineering at scale; voice and video synthesis that defeats identity verification based on biometrics; and code generation that accelerates exploit development and malware creation. Each is examined in detail below.

Phishing is the most common initial access technique in cyberattacks, responsible for over 68% of data breaches. AI has transformed it from a volume game (send millions of generic emails) to a precision game (send a small number of highly personalised emails to high-value targets, each one constructed from OSINT gathered and synthesised by an LLM in seconds).

A modern AI-assisted spear phishing pipeline operates in four automated stages. The attacker defines the target organisation and a list of individuals. The pipeline then:

WormGPT -- a jailbroken LLM fine-tuned on malware and cybercrime data and sold on dark web forums from mid-2023 -- demonstrated that the criminal ecosystem rapidly commoditises AI capabilities.

By 2025, multiple successors existed: FraudGPT (optimised for financial fraud and phishing), DarkBARD, EvilGPT, and custom fine-tuned models trained on leaked datasets of successful phishing emails and malware code. These tools do not represent fundamentally novel capability beyond what legitimate LLMs can produce with prompt engineering -- but they remove the need for prompt engineering and jailbreaking, making offensive AI accessible to low-skill threat actors.

Historically, phishing emails targeting non-English speakers often contained obvious grammatical errors that trained users could spot. LLMs are fluent in over 100 languages with native-level accuracy.

An attacker targeting a Japanese financial institution, a French healthcare provider, or a German manufacturer can generate perfectly constructed, culturally appropriate phishing emails in the target's native language with zero additional effort. This removes one of the last reliable tells that trained non-English-speaking employees could use to identify phishing.

Synthetic media -- AI-generated audio and video that realistically portrays real people saying or doing things they never said or did -- has moved from a laboratory curiosity to a financially devastating fraud vector in under five years. The barrier to creating convincing deepfakes has collapsed: tools that required a research lab in 2020 are now available as free mobile applications and APIs in 2026.

AI voice cloning models (ElevenLabs, Resemble AI, and numerous open-source alternatives) can replicate a specific person's voice from as little as three seconds of publicly available audio -- a YouTube video, a podcast appearance, an earnings call recording, a conference talk. The cloned voice is indistinguishable from the original in most conditions. Documented financial fraud using voice cloning:

• 2019 -- First documented CEO voice fraud (UK energy firm): Criminals cloned the voice of the CEO of a German parent company and called the UK subsidiary's finance director, instructing him to transfer €220,000 to a Hungarian supplier. The finance director described the voice as identical to his CEO's, including his German accent and speech pattern. The transfer was made.
• 2024 -- Hong Kong deepfake video call ($25.6M): A finance employee attended a video conference call with who appeared to be their company's CFO and several colleagues. All other participants were real-time deepfakes. The employee was instructed to make 15 transfers totalling HK$200 million ($25.6M). He had initially suspected a phishing email but the video call reassured him.
• 2025 -- Singapore C-suite deepfake ($4.3M): The case described in the opening paragraph. Deepfake generated from conference video footage; voice cloned from an earnings call recording.

Real-time face-swapping -- replacing a person's face with a target's face in a live video call -- reached sufficient quality for fraud purposes by late 2024. Tools like DeepFaceLive, Roop, and commercial API services can swap faces in real time with latency under 50ms, within the normal variation users experience in video calls. In 2026, detection of real-time deepfakes requires either technical analysis tools or specific verification challenges that the deepfake pipeline cannot resolve.

Code generation AI (GPT-4o, Claude, Gemini, Codex, and specialised coding models) significantly accelerates malware development for threat actors with limited programming skills. The assistance does not only involve writing malicious functionality -- it includes generating polymorphic variants that evade signature detection, translating malware from one language to another, and suggesting evasion techniques for specific security products.

• Polymorphic code generation: Automatically generate functionally equivalent variants of a malware payload with different code structures, variable names, and obfuscation patterns -- each variant presents a different signature to AV engines. What previously required skilled malware authors can now be automated at scale, producing hundreds of unique variants from a single original.
• Evasion technique suggestion: LLMs trained on security research can suggest specific evasion techniques for named security products. An attacker can describe the target environment (CrowdStrike Falcon, Windows Defender, specific EDR version) and receive suggested techniques to evade detection: syscall unhooking, PPID spoofing, ETW patching, indirect syscalls.
• Payload adaptation: Rewrite an existing public proof-of-concept exploit into a production-quality payload with error handling, C2 communication, and persistence. PoC to weaponised exploit in hours rather than weeks.
• Script kiddie uplift: The most significant impact: attackers with limited programming skill can now produce moderately sophisticated malware. The expertise gap between nation-state threat actors and opportunistic criminals has narrowed significantly.

AI-generated polymorphic malware renders signature-based detection increasingly unreliable as the primary defence. The defensive shift required: behavioural detection (what the malware does, not what it looks like), memory scanning (detect shellcode execution patterns in memory), and EDR telemetry (process behaviour, network connections, file system activity).

An EDR that detects CreateRemoteThread called from a suspicious parent process catches the polymorphic variant because the behaviour is the same even when the code looks completely different. YARA rules targeting behaviour patterns and memory artefacts rather than code strings are more resilient to AI-generated polymorphism.

Reconnaissance -- gathering intelligence about a target before an attack -- was historically constrained by human analyst time. Processing hundreds of employee LinkedIn profiles, identifying the organisational hierarchy, mapping technology stack from job postings and GitHub, correlating breach data with current email formats, and building a target dossier sufficient to plan a convincing attack required hours or days of skilled analyst work per target. LLMs and AI automation pipelines have reduced this to minutes.

• Organisational mapping: LLMs process LinkedIn data to construct a complete organisational chart including reporting relationships, tenure, technology focus areas, and recent career changes (a new CFO unfamiliar with existing procedures is a higher-value BEC target than a 10-year incumbent).
• Technology stack identification: Job postings (require experience with Splunk, AWS, Palo Alto) reveal the security toolset. GitHub repositories reveal coding languages and frameworks. Shodan and Censys reveal internet-facing infrastructure. An LLM synthesises all sources into a technology profile in seconds.
• Breach data correlation: AI tools cross-reference known breach datasets (credentials from previous breaches) against identified targets. Employees who use the same password across services are identified as credential-stuffing targets.
• Supply chain mapping: Identify the target organisation's key suppliers, software vendors, and managed service providers from public sources. Suppliers become attack vectors -- a breach of a trusted supplier provides a path to the original target with legitimate credentials and access.
• Optimal attack timing: Analyse public sources for events that create optimal attack windows: CFO changes (transition period), mergers and acquisitions (confusion and new relationships), large IT projects (change management creates access), earnings periods (finance teams under pressure).

AI is accelerating the vulnerability discovery and exploitation cycle at both ends: helping defenders find vulnerabilities in their own code faster, and simultaneously helping attackers find and exploit those same vulnerabilities before patches are applied. The net effect depends on which side deploys AI tools more effectively and quickly.

Most vulnerability scanners (Nessus, Qualys) match software versions against CVE databases. AI-augmented scanning goes further: static analysis of code (SAST) to find vulnerabilities that have no CVE yet; fuzzing guided by machine learning to find memory corruption bugs faster than traditional random fuzzing; and analysis of patch diffs to identify the vulnerability class and write exploit code before the vendor's patch has deployed widely.

Given a CVE description and the affected code, LLMs can suggest exploit approaches, generate proof-of-concept code, and identify the memory layout required for exploitation. Security researcher research in 2025 demonstrated that GPT-4 class models could successfully exploit one-day vulnerabilities (patched but not yet widely deployed) from only the CVE description and a copy of the vulnerable binary, without prior knowledge of the specific exploit. The time from CVE publication to working exploit -- which historically took skilled researchers days to weeks -- is compressing toward hours for certain vulnerability classes.

CISA's Known Exploited Vulnerabilities catalogue shows that the median time from CVE publication to exploitation in the wild dropped from 44 days in 2021 to 12 days in 2025. AI-assisted exploit development is a significant contributor. For organisations with 30-day critical patch SLAs (already aggressive by industry standards), a 12-day median exploitation window means patches must be applied faster, or compensating controls (WAF rules, IPS signatures, network segmentation) must be deployed within days of CVE publication while the patch is prepared and tested.

Traditional password cracking uses wordlists and rule-based mutations (adding numbers, replacing letters with symbols). AI-powered password cracking goes further: machine learning models trained on large breach datasets learn statistical patterns in how humans construct passwords. Given partial information about a target (their name, birthday, interests, employer, previous passwords from breaches), the model generates a targeted password candidate list that is significantly more likely to contain the actual password than a generic wordlist.

PassGAN (2023) demonstrated that a GAN trained on breach datasets could crack 51% of passwords in under a minute -- not because it was faster than GPU-based Hashcat, but because it generated better candidates. Subsequent work in 2025 showed that when combined with personal OSINT (name, interests, known password fragments from previous breaches), AI-assisted password guessing outperforms traditional approaches by 3-5x for targeted attacks.

AI assists credential stuffing (using username/password combinations from data breaches against other services) by: prioritising which credentials to test first based on account value estimation; generating realistic browser fingerprints and behaviour patterns to evade bot detection; rotating through proxy networks and timing attacks to avoid rate limiting; and automatically detecting successful logins and prioritising accounts for manual follow-up based on what the account contains.

• Phishing-resistant MFA (FIDO2): Renders stolen passwords useless without the second factor. Even AI-optimised password cracking is irrelevant if credentials cannot be used without a FIDO2 key that is cryptographically bound to the legitimate site.
• Breached password detection: Microsoft Entra ID Password Protection, HaveIBeenPwned integration -- block passwords known to be in breach datasets before attackers try them.
• Behavioural anomaly detection: Logins from new devices, unusual locations, or at unusual times trigger step-up authentication or alerts regardless of credential validity.

Defending against AI-assisted attacks does not require AI-specific silver-bullet solutions -- most of the effective controls are hardened versions of existing security fundamentals. AI makes attacks faster and more convincing, not fundamentally different in mechanism. The key insight: AI-powered phishing still delivers credentials to a phishing proxy; phishing-resistant MFA still stops credential theft regardless of how convincing the phishing email was.

Security vendors are deploying AI detection on the defensive side: AI-generated phishing email detection (Proofpoint, Abnormal Security) that identifies statistical patterns in LLM-generated text; deepfake audio detection in call centres (Pindrop) that analyses spectral characteristics of AI-synthesised voice; anomaly detection in user behaviour (UEBA) that identifies AI-automated credential stuffing from the velocity and pattern regularity of login attempts.

The arms race between AI-generated attacks and AI-powered detection is ongoing, with neither side achieving a stable advantage. Organisations should deploy AI detection tools as a layer while maintaining robust procedural controls (safe words, callback policies, dual authorisation) that do not depend on technology to function.

The deepfake finance director who wired $25.6M and the accounts payable clerk who sent £340,000 were not foolish or untrained -- they were operating in environments where AI-generated fraud was indistinguishable from legitimate communications by any technical means available to them at the time.

The control that would have prevented both losses requires no technology: a simple policy that any payment request made via an unusual channel (WhatsApp, a new email address, a video call not scheduled through normal channels) requires a callback to a verified number before processing. This policy costs nothing to implement, requires no AI tools, and would have stopped both attacks completely.