How Hackers Use AI and How to Defend Against It

A finance manager gets a voicemail from the CEO. It’s his voice, his phrasing, even the way he clears his throat. He needs a payment sent before a deal closes. Nothing about the call sounds wrong, because nothing about it is human.

AI hasn’t invented new crimes. It has made old ones cheaper, faster and more convincing. In its 2025 Internet Crime Report, the FBI’s Internet Crime Complaint Center (IC3) logged more than 22,000 complaints that referenced AI, with adjusted losses of over $893 million. That figure only counts cases where victims knew, or suspected, that AI was involved.

This guide covers the 4 ways attackers use AI most today and the defense that matches each one. The pattern you’ll notice: most defenses don’t require AI at all.

What has actually changed

Security teams have heard a lot of hype about “AI super-hackers”. The reality from threat intelligence teams is more grounded, and more useful for planning.

Google’s Threat Intelligence Group (GTIG) has published a series of reports since early 2025 on how threat actors misuse AI. Through 2025, it mostly saw attackers using AI as a productivity tool: researching targets, translating lures, writing and debugging code. By late 2025 it reported the first malware families that call large language models while running, and in May 2026 it reported a criminal group using a zero-day exploit it believes was developed with AI help.

In November 2025, Anthropic reported disrupting a campaign it attributed with high confidence to a Chinese state-sponsored group. The group used Claude Code to attempt intrusions against roughly 30 organizations, with AI performing most of the tactical work and a small number of attempts succeeding. The AI also made mistakes, such as hallucinating credentials.

The takeaway for a business owner: attackers can now do more, at greater scale, with fewer skills. But they still rely on the same entry points: a person who trusts a message, a password without strong MFA, or an unpatched system.

1. AI-written phishing and business email compromise

Large language models write fluent, polite, error-free text in any language and any tone. That removes the classic giveaways of phishing: bad grammar, odd phrasing and generic greetings.

The FBI warned in a December 2024 public service announcement that criminals use generative AI to make fraud more believable and to run it at greater scale. Its 2025 report adds that chat generators can quickly create official-sounding emails mimicking a company’s CEO, and that businesses reported over $30 million in losses to business email compromise involving AI in 2025.

GTIG has also described attackers using AI to map organizational hierarchies and third-party relationships, so lures can be tailored to finance, HR and security staff.

How to defend against it

• Stop training people to spot typos. Teach them to spot requests instead: payment changes, password resets, gift cards, urgent wires, unexpected file shares.
• Use phishing-resistant MFA. CISA calls FIDO/WebAuthn authentication, including security keys and passkeys, the only widely available phishing-resistant option. A perfect phishing page can’t steal a passkey.
• Verify money requests out of band. Follow the callback process in our guide to business email compromise: call back on a number you already have, and require a second approver.
• Make reporting easy. A one-click “report phishing” button and a thank-you from IT do more than annual training alone.

2. Voice cloning and deepfake video

Publicly available audio, such as a podcast, a sales webinar or a voicemail greeting, can give criminals the raw material to clone a voice. Attackers use clones to call staff as an executive, call banks as a customer, or call families as a relative in trouble.

The FBI’s 2025 report describes voice cloning used in BEC wire requests, in “distress” scams that mimic a loved one, and in fake job interviews where the video and audio don’t quite line up. In May 2025, the FBI also warned that criminals were sending AI-generated voice messages impersonating senior US officials.

Regulators have responded too. In February 2024, the Federal Communications Commission ruled that AI-generated voices count as “artificial” voices under the Telephone Consumer Protection Act, making voice-clone robocalls without prior consent illegal. That helps with enforcement, but it won’t stop a criminal from calling your accounts payable line.

How to defend against it

• Treat a familiar voice as unverified. A voice or face on a call is no longer proof of identity for anything involving money, credentials or data.
• Set up code words. The FBI recommends families agree on a secret word or phrase to verify each other. The same works for executives and finance staff.
• Hang up and call back. Use a number you already have, not the one that called you.
• Require dual approval for payments so no single phone call can move money.
• Screen remote hires carefully. Ask candidates to turn their head or wave a hand in front of their face on video, and verify identity documents through a trusted process.

Our guide on how to spot a deepfake covers visual and audio warning signs in more detail.

3. AI-assisted reconnaissance, scanning and exploits

Attackers have always scanned the internet for weak systems. AI speeds up the slow parts: reading vulnerability write-ups, adapting proof-of-concept code, and chaining tools together.

GTIG’s May 2026 report describes state-linked groups sending thousands of prompts to analyze known vulnerabilities and validate exploits, and frameworks that automate attack-surface mapping and vulnerability validation. The zero-day GTIG believes was AI-developed was a two-factor authentication bypass in an open-source web administration tool, and the group behind it planned mass exploitation.

What this means: the window between a vulnerability becoming public and attackers exploiting it keeps shrinking, and small organizations get swept up in automated campaigns they were never specifically chosen for.

How to defend against it

• Know what you expose. Keep a list of every internet-facing system: VPNs, firewalls, remote desktop, web apps, file transfer tools and admin panels.
• Patch internet-facing systems first. Check CISA’s Known Exploited Vulnerabilities catalog and prioritize anything on it.
• Remove what you don’t need. Close remote desktop to the internet, retire old servers and put admin panels behind a VPN or zero trust access.
• Assume credentials leak. Combine MFA with least privilege and the principles of zero trust security, so one stolen login doesn’t open everything.
• Keep offline backups. If automated attacks lead to ransomware, tested offline backups are your recovery path. See our ransomware protection guide.

4. Attacks on your own AI tools

As companies adopt chatbots, copilots and AI agents, those tools become targets. GTIG’s 2026 reporting describes attackers compromising AI software dependencies and integrations as a way in, including malicious packages disguised as AI agent “skills”.

Common risks include:

• Prompt injection. Hidden instructions in a web page, document or email trick an AI assistant into leaking data or taking actions.
• Malicious plugins and connectors. An AI agent extension that looks useful but quietly runs unauthorized code or sends data elsewhere.
• Over-permissioned agents. An agent with access to email, files and payment systems can do real damage if it’s manipulated.
• Data leakage. Staff pasting sensitive data into tools that store or train on it.

How to defend against it

• Write an AI acceptable use policy that lists approved tools and what data can go into them. Our guide on how to write an AI acceptable use policy has a template.
• Give agents the least access they need, and require a human to confirm sensitive actions such as sending money or deleting data.
• Vet plugins, skills and connectors like any other software: known publisher, minimal permissions, reviewed before install.
• Read our guide on whether it’s safe to put company data into AI before rolling tools out widely.

Key takeaway: AI makes attacks more convincing, but it doesn’t change where they land. Protect the 3 targets AI attacks still need: your people’s trust, your logins and your exposed systems.

Should you use AI for defense too?

Yes, but as an add-on, not a foundation. Many email security, endpoint protection and identity tools already use machine learning to spot unusual logins, suspicious messages and malware behavior. Security vendors and large tech companies are also using AI to find vulnerabilities before attackers do.

For a small or mid-sized business, the practical move is to choose security tools with strong detection built in, rather than buying a separate “AI security” product. If you work with a managed IT or security provider, ask how their tools detect AI-generated phishing and unusual account activity, and how fast they respond to alerts.

Where to start: a 30-day plan

1. Week 1: Turn on MFA everywhere, starting with email, banking, payroll and admin accounts. Move finance and executives to passkeys or security keys.
2. Week 1: Write a 1-page callback rule for payments and bank detail changes, and set dual approval in online banking.
3. Week 2: Agree on code words for executives, finance staff and anyone who can approve payments. Remind staff that voices and video can be faked.
4. Week 2: List your internet-facing systems and check them against CISA’s Known Exploited Vulnerabilities catalog.
5. Week 3: Publish an AI acceptable use policy and an approved tools list.
6. Week 4: Run a short training session using real examples of AI-written phishing and voice clone scams, and test your offline backups.

For a wider view of what’s coming, read our cybersecurity trends 2026 guide.

Conclusion

AI gives attackers better writing, better impersonation and faster research. It doesn’t give them a way around a callback rule, a passkey or a patched server. Focus on verifying requests through a second channel, making logins phishing-resistant and shrinking what you expose to the internet. Those 3 habits defend against both today’s AI cyber attacks and the next wave.

Sources

• FBI IC3: 2025 IC3 Annual Report — AI-related complaint and loss figures, AI use in BEC, distress, employment and investment scams
• FBI IC3: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (PSA, December 2024) — how criminals use generative AI and the secret word recommendation
• Google Threat Intelligence Group: Adversaries leverage AI for vulnerability exploitation, augmented operations and initial access (May 2026) — AI-developed zero-day, vulnerability research at scale, attacks on AI dependencies
• Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign (November 2025) — AI agents used to carry out most tactical operations in an intrusion campaign
• FCC: FCC Makes AI-Generated Voices in Robocalls Illegal — February 2024 TCPA declaratory ruling on AI-generated voices
• CISA: Implementing Phishing-Resistant MFA — FIDO/WebAuthn as the widely available phishing-resistant MFA