Hackers Use Generative AI to Create Custom Malware That Evades Traditional Security

Hackers are using generative AI to create custom malware, rewrite harmful scripts, and make phishing messages harder to detect.

This shift strains security tools that rely mainly on known file signatures and enables ransomware operators to move faster from initial access to data theft and encryption.

The risk is not that every AI-generated program will evade detection, but that attackers can produce unfamiliar code far more quickly, reducing the effectiveness of rules built around older samples.

At the same time, improved language capabilities help fraudulent emails and websites blend into normal business communications, making familiar warning signs less reliable.

Researchers at Zscaler highlighted these trends in an analysis of AI-enabled ransomware published on October 16, 2026. Written by principal information security researcher Phil Hagen, the report describes how attackers apply AI across social engineering, data discovery, and malware development.

The report focuses on broad techniques rather than naming a new malware family or tying activity to a single confirmed campaign.

Hackers Use Generative AI

Traditional security products often detect threats by comparing files and network traffic against known patterns. Signatures remain useful for spotting familiar threats, but their limitations become clear when attackers continually change the code that achieves the same malicious outcomes.

Zscaler says generative AI makes those code changes faster and easier to produce. Attackers can also build bespoke tools instead of reusing widely available programs that defenders already monitor.

Related reporting on AI agents automating cyberattacks shows how code generation and frequent rebuilding can shorten attack workflows. For defenders, unfamiliar tooling means fewer reliable matches to previously collected samples.

That also complicates attribution. Custom malware once implied access to skilled developers or substantial funding. Zscaler warns that readily available language models now give smaller ransomware groups similar development capabilities, making unique tooling a weaker indicator of an attacker’s resources or identity.

The distinction between AI-assisted development and malware that uses AI at runtime is important. Zscaler documents rapid script creation and revision, not evidence that every payload autonomously rewrites itself. Coverage of self-modifying malware addresses that separate capability, which would further weaken checks based on fixed file patterns.

Better Phishing and Faster Data Theft

Attacks often begin before any custom malware executes. Generative AI can help criminals craft clear emails, produce convincing websites, and communicate naturally in a target’s language.

This reduces obvious spelling and grammar errors that many employees have been trained to treat as phishing indicators. Zscaler also describes phishing that persuades users to install or run remote monitoring and management (RMM) software.

RMM tools have legitimate business uses, but attackers can abuse them to control a victim’s computer and potentially move laterally within a network. That initial deception can therefore open a path beyond a single device.

Web content poses an additional challenge. Research on GenAI-generated malicious web pages shows how code created after a page loads can change what users encounter. That browser-based technique is separate from Zscaler’s analysis but illustrates why reviewing only a page’s initial content may miss harmful behavior that appears later.

Once inside a network, attackers can use AI to search and classify large volumes of accessible information. Zscaler says this helps them locate valuable material for theft or encryption faster than traditional scripts and playbooks.

Finding sensitive data sooner increases pressure on victims facing ransom demands or threatened disclosure. The central problem is a shorter response window: faster discovery and custom-script development leave defenders less time to connect suspicious activity before files are stolen or encrypted.

Detection therefore needs to consider what a program does, not just whether its file matches a known malicious sample. Zscaler points to AI-based detection, correlated security data, and faster investigation as defensive measures.

The report describes controls aimed at phishing sites, attacker command-and-control infrastructure, suspicious browser content, and ransomware response. These are vendor-described capabilities and do not prove that any single product can stop every AI-assisted attack.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from SOCs to improve detection and response.