GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

This report from Google Threat Intelligence Group (GTIG) documents how adversaries are increasingly leveraging AI models to accelerate their attack capabilities across multiple stages of the threat lifecycle.

• •Threat actors have developed zero-day exploits using AI-generated code, with at least one cyber crime group planning a mass exploitation event before being disrupted
• •AI-driven malware development enables faster creation of polymorphic malware with advanced defense evasion techniques and obfuscated decoy logic
• •Autonomous AI-powered malware like PROMPTSPY demonstrates dynamic command generation and adaptive attack orchestration without human intervention
• •Adversaries are using AI for scaled vulnerability research, information operations, deepfake generation, and social engineering at unprecedented speed