Cybercriminals Rely on AI Tools, But Does It Really Enhance Their Effectiveness?
In recent years, the landscape of cybercrime has seen a notable shift as cybercriminals increasingly turn to artificial intelligence (AI) tools to bolster their malicious campaigns. Despite widespread concerns regarding the potential for a dramatic increase in cyber threats due to these advancements, Selena Larson, a principal threat researcher at Proofpoint, has asserted that AI has not fundamentally changed the landscape of cyber threats. In fact, she argues that AI may even diminish the effectiveness of certain attacks.
Larson delivered her insights during the IRISSCON 2026 conference in Dublin, Ireland, on November 11, emphasizing her view that the anticipated enhancement of hacker capabilities through AI is overstated. She coined the phrase "marketing nonsense" to describe the narrative that AI would make attackers "better, faster, and stronger" by granting them access to tools and resources comparable to those of elite developers and cybersecurity experts. Larson asserted that data do not support this prevailing assumption, highlighting a disconnection between marketing claims and the realities of cyber threats.
The Dangers of "AI Slop"
While it is true that AI has allowed threat actors to increase the speed and scalability of their operations, many groups appear to have become overly reliant on these technologies, resulting in a phenomenon Larson referred to as "AI slop." According to Proofpoint’s research, instances of malfunctions in AI-generated malware have been regularly observed. Larson pointed out that researchers often encounter malware that fails to function as intended, with embedded comments indicating different actions than what the code actually executes. This inconsistency is a sharp reminder of the pitfalls associated with relying too heavily on AI tools.
Drawing attention to specific cases, Larson noted her observations of phishing campaigns conducted by a group known as TA4903, which specializes in business email compromise (BEC). Historically, this group has successfully impersonated U.S. government entities to target diverse organizations with sophisticated lures. However, since integrating AI tools into their campaigns, the quality of their lures has notably declined. AI-generated emails often lack coherence, with subject lines failing to align with attachments and sometimes even featuring empty message bodies.
Compounding this issue, the group now constructs phishing websites through AI coding tools. These "vibe coded" sites tend to exhibit simplistic designs with similar color schemes and formatting, making them easier for discerning targets to identify as fraudulent. Larson raised an interesting point regarding the use of AI for maintaining region-specific grammar and spelling in phishing messages, suggesting that this may unintentionally detract from the believable nature of their lures. "Human beings often don’t know how to spell," she commented, underscoring a reality that AI’s attempts to generate polished content could work against cybercriminals’ efforts.
Vulnerabilities and Flaws in Exploitation
Larson also addressed the realm of vulnerability exploitation, where AI can indeed identify and exploit flaws at a rapid pace. However, she cautioned that AI-generated exploits frequently exhibit significant weaknesses compared to those crafted by human expertise. An illustrative example she provided was the ‘BlueMoon’ exploit chain, initially observed in August 2026. This chain leveraged vulnerabilities within Microsoft’s Chrome browser, but the exploits produced through large language models (LLMs) often acted erratically, generating substantial noise that made them easy for cybersecurity defenders to notice.
Highlighting these shortcomings serves to reinforce Larson’s thesis that while AI may facilitate certain aspects of cybercrime, it does not inherently enhance the sophistication or effectiveness of attacks.
The Continued Relevance of Cyber Defense Strategies
Despite the advancements and discussions surrounding AI in cybercrime, Larson underscored the importance of recognizing that AI remains primarily a productivity tool. It does not automatically augment the sophistication of threat actor operations. "AI is only as good as its operator," she noted, warning that reliance on AI could lead to increased errors and sloppy mistakes.
Crucially, Larson stressed that the core principles of cyber defense have not changed. While AI may enable quicker and easier exploitation of long-known vulnerabilities, the fundamental strategies for defense remain the same. "Attacks are attacks, and AI generally doesn’t really matter," she emphasized, indicating that the essence of cybersecurity remains constant, regardless of technological advancements.
In conclusion, as the debate continues regarding the intersection of AI and cybercrime, Larson’s insights suggest that the anticipated transformation in cyber threats might not be as significant as once believed. The notion of AI as a game-changing tool for cybercriminals is challenged by evidence indicating a trend toward less effective attacks. Instead, the focus remains on enhancing traditional defense mechanisms, which are more vital than ever in navigating an evolving threat landscape.