How AI Is Showing Up in Real Attacks: Report

This report examines how threat actors are integrating AI into familiar tradecraft — primarily phishing, social engineering, identity fraud, and malicious tooling — to increase scale, speed, and plausibility of attacks; it highlights observed campaigns (thousands of phishing pages, 30–40 parallel device-code phishing domains), rapid post-compromise activity (web shells deployed across multiple hosts within hours, one case with a 60-second reconnaissance), and recommends defenders focus on behavior-based visibility and automated correlation rather than surface-level AI “tells”.