Hackers Use Generative AI to Build Custom Malware and Bypass Traditional Security Detection

Hackers are using generative AI to build custom malware, rewrite harmful scripts, and make phishing messages harder to spot.

The shift puts pressure on security tools that mainly depend on known file signatures, while helping ransomware operators move faster from their first foothold to data theft and encryption.

The danger is not that every AI-generated program escapes detection. Instead, attackers can produce unfamiliar code more quickly, reducing the value of rules built around older samples.

At the same time, better language support helps their fake emails and websites blend into normal business activity, making familiar warning signs less dependable.

Researchers from Zscaler noted these changes in an analysis of AI-enabled ransomware published on October 16, 2026. Written by principal information security researcher Phil Hagen, the report describes how attackers use AI across social engineering, data discovery, and malware development.

It examines broader methods rather than identifying a newly named malware family or a single confirmed campaign.

Hackers Use Generative AI

Traditional security products often compare files and network traffic against known patterns. These signatures remain useful for spotting familiar threats, but their limits become clearer when attackers keep changing the code that produces the same harmful result.

Zscaler says generative AI makes those changes faster and easier to produce. Attackers can also build their own tools instead of relying on widely used programs that defenders already track.

Related reporting on AI agents automating cyberattacks describes how code generation and repeated rebuilding can shorten attack workflows. For defenders, unfamiliar tooling means fewer dependable matches against previously collected samples.

This also complicates efforts to identify who carried out an attack. Custom malware once suggested access to skilled developers or substantial funding.

Zscaler warns that readily available language models now give smaller ransomware groups similar development options, making unique tools a weaker clue when assessing an attacker’s resources or identity.

The distinction between AI-assisted development and malware that uses AI while running matters. Zscaler describes rapid script creation and revision, not proof that every payload independently rewrites itself.

Coverage of malware that rewrites itself explores that separate development, where changing code can further weaken checks based on fixed file patterns.

Better Phishing and Faster Data Theft

The attack often begins before any custom malware runs. Generative AI can help criminals write clear emails, create convincing websites, and communicate naturally in a target’s language.

This reduces obvious spelling and grammar mistakes that many employees have been trained to treat as signs of phishing. Zscaler also describes phishing messages that persuade users to run remote monitoring and management software.

These tools have legitimate business uses, but attackers can abuse the access they provide to control a victim’s computer and potentially reach other systems. The initial trick can therefore open a path beyond one device.

Web content creates another challenge. Research covered in GenAI-generated malicious web pages shows how code created after a page loads can change what users encounter.

That browser-based technique is separate from Zscaler’s analysis, but it illustrates why reviewing only a page’s initial content may miss harmful behavior that appears later.

Once inside a network, attackers can use AI to search and classify large amounts of accessible information. Zscaler says this helps them locate valuable material for theft or encryption faster than traditional scripts and playbooks.

Finding sensitive data sooner can increase pressure on victims facing ransom demands or threatened public disclosure.

The central issue is a shorter response window. Faster discovery and custom script development leave defenders less time to connect suspicious activity before files are stolen or encrypted.

Detection therefore needs to consider what a program does, not simply whether its file matches a known malicious sample. Zscaler points to AI-based detection, combined security data, and faster investigation as defensive measures.

Its report describes controls aimed at phishing sites, attacker command infrastructure, suspicious browser content, and ransomware response. These are vendor-described capabilities, not evidence that one product can stop every AI-assisted attack.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Use Generative AI to Build Custom Malware and Bypass Traditional Security Detection appeared first on Cyber Security News.