The latest intelligence shows cybercriminals harnessing artificial intelligence not for isolated malware, but to power fully autonomous fraud schemes and abuse digital trust. By mimicking legitimate behaviors—like approving payments, logging in, or even assuming a trusted voice—the attacks are evolving to become harder to detect and stop in real time. Accessibility to trusted apps is no longer proof of safety when imposters move with speed and precision.
Automation of Espionage & Mobile Attacks
A prime example can be seen in the China-linked campaign dubbed GTG-1002, where AI agents handled roughly 80–90% of operational tasks—from reconnaissance to credential theft—while people made just four to six overarching decisions, such as selecting victims and approving stolen data. Meanwhile, Android malware called PromptSpy leverages on-device screenshots and adjusts its behavior in real time, using accessibility privileges to spy on activity, overlay fake controls, and hide from uninstallation.
Familiar Interactions, Hidden Threats
Some attacks rely on trust built into routine workflows. Deepfake calls, for instance, have convinced finance staff to approve transfers totaling up to $25 million by impersonating company executives through convincing audio and video. In another case, fake checkout forms—hidden beneath failing screens—siphon off payment details before redirecting users to legitimate ones, allowing theft to go unnoticed. Even after systems are restored from intrusions, disclosed files can fuel extortion campaigns, deepening the fallout.
New Defense Strategies to Meet New Risks
Security experts advise adopting continuous verification across identity and behavior—not just trusting logins or interfaces. Suggestions include: bi-directional confirmation for high-value requests (for example via callback or pre-established code); strict controls over mobile app permissions; regular testing of payment workflows to detect fake overlays; exposure monitoring; phishing-resistant authentication; and strong document encryption. Also emphasized is vigilance around unusual device behaviors, rather than relying on familiar interfaces to assume safety.
This new phase of AI-powered cyberattacks signifies a departure from traditional malware towards sophisticated abuse of trust and automation. Organizations must rethink security models: emphasizing not just identity, but behavior, context, and ongoing validation. Defense posture needs to shift from reactive to anticipatory—everyone from CISOs to individual users should expect familiar scenes to potentially hide malicious intent.
