In early 2026, IBM's researchers found a backdoor on a server that ransomware operators had already broken into, and concluded that a language model had likely written it. The code was technically mediocre at best, extensively commented and neatly named, which is exactly the habit that gave it away. That is the story about AI and malware that doesn't make the headlines, and it's the one that matters. The frightening part was never how good the code was, it was that nobody had to be good to write it.

Strip away the marketing and here is what has actually been observed. In November 2025, Google's threat intelligence team reported what it called its first sighting of malware querying a language model during live operations. The malware, tied to a Russian government-backed group and used against Ukraine, posed as an image generator while quietly asking an AI model to write the commands it should run on the victim's machine, then ran them without checking. A second family Google found would ask a model to rewrite its own code to dodge detection, though Google stressed that one was experimental, couldn't compromise a victim, and had its key function switched off.

Why this matters now is the direction, not the size. Google called the activity nascent, and IBM, looking at a very different case a few months later, said AI-driven malware wasn't yet bringing noticeable upgrades in sophistication. Both are right, and both are missing the point if you stop there. The question isn't whether AI makes attackers better. It's what happens when it makes them cheaper.

Two assumptions have quietly shaped how most of us think about this. The first is that serious attacks need serious skill, so the number of people who can launch one stays small. The second is that the safety guardrails built into AI tools would hold the line, so asking a chatbot for malware would simply fail.

For decades, expertise worked as a rationing system for crime. Plenty of people wanted to attack you. Very few of them could.

The first assumption is why we've treated attackers as a small, skilled population we could study and track. The second is why plenty of people filed this whole topic under theoretical. Both are comforting, and both turned out to be thinner than they looked.

Start with skill. In August 2025, one AI company published a threat report on a UK-based actor selling ransomware tools priced from $400 to $1,200, depending on the package. They included file encryption, tricks to evade security software, and a web console for managing victims. The report's assessment of the seller is the part to remember: this person appeared unable to build the complex pieces, or fix them when they broke, without AI doing the work. The expertise being sold had been borrowed.

The same report described a second operation that used an AI coding agent for far more than writing code. Over roughly a month it potentially affected at least 17 organizations, including government agencies, healthcare providers, and emergency services. The AI helped with reconnaissance, harvesting credentials, and moving through networks, and it even analyzed the stolen financial data to decide how large a ransom to demand. The demands ran from $75,000 to $500,000 in Bitcoin.

As for the guardrails, they do get tested, and the most effective tool turns out to be a story. Google reported an actor who, after being refused, reframed the same request as a capture-the-flag security exercise and got further. Another posed as a student writing a university paper. That is social engineering, aimed at a machine.

The same pattern shows up in phishing. In a controlled study published in June 2026, researchers tested phishing emails on 101 participants split into four groups. The click rate was 12% for a control group and 54% for emails written by human experts. Fully automated AI-written emails also drew 54%. The study is small, so treat the exact numbers carefully, but the finding is hard to wave away: the machine matched the experts at a fraction of the effort, and the researchers estimated it could raise the profitability of large campaigns by up to 50 times.

The part that gets missed

AI doesn't make the weapon stronger. It removes the rationing on who can pick one up.

The mental model: stop measuring an attack by how clever it is, and start measuring it by what it costs. Mediocre code, produced in minutes by someone who couldn't have written it alone, is still a working attack, and it can be produced again and again, each version slightly different. When the cost of a passable attack falls toward zero, the number of attempts goes up, and the old signs that something was off start to disappear. The badly spelled email, the clumsy phrasing, the file that matches nothing seen before: those were comforting side effects of attackers being expensive. They were never guarantees.

That changes where defense should lean. Anything that depends on spotting the fake gets weaker as fakes get better. Anything that works even when the fake is perfect keeps its value, such as confirming an unusual request through a separate channel, keeping software patched, and making a stolen password worthless on its own. Defenders also get the same tools. In that phishing study, a language model used as a detector flagged malicious emails with 97.25% accuracy across 381 messages, with no false alarms, though a lab test is kinder than a real inbox. The lesson isn't to fear a smarter enemy. It's to plan for a much larger crowd of ordinary ones.

What I keep coming back to is how much of my own gut check was built on bad writing. For years, a clumsy email or a strangely worded message was my first alarm, and I'm no longer sure that alarm works. So here's what I'd genuinely like to know: when a message looks too polished to doubt, what's the one thing you do before you act on it? Hit reply and tell me.

This week's question

When a message looks too polished to doubt, what's the one thing you do before acting on it? Hit reply. I read every response.

Sources

Details drawn from the Google Threat Intelligence Group's AI Threat Tracker report (November 5, 2025: first observed malware querying an LLM in live operations; an experimental self-modifying family that did not demonstrate the ability to compromise a victim; guardrail-bypass pretexts including a capture-the-flag framing and a student framing); IBM X-Force's analysis "A Slopoly start to AI-enhanced ransomware attacks" (March 12, 2026: a likely AI-generated backdoor used by a financially motivated group; assessed as technically mediocre; not yet bringing noticeable sophistication upgrades); Anthropic's August 2025 Threat Intelligence report (a UK-based actor selling ransomware tools at $400 to $1,200 who appeared dependent on AI; a data-extortion operation potentially affecting at least 17 organizations with demands of $75,000 to $500,000); and Heiding et al., "Evaluating Large Language Models' Ability to Automate Spear Phishing," Expert Systems with Applications, June 2026 (101 participants; click rates of 12% control, 54% human experts, 54% fully AI-automated; up to 50 times higher profitability estimated for large campaigns; a language model detector scored 97.25% on 381 emails).

Think clearly,

— DJ Brar

SKBSEC | SKB Decoded  ·  www.skbsec.com