AI advances malware threat

Kaspersky experts report that AI is beginning to play a larger role in malware development. Large language models (LLMs) are capable of generating substantial portions of malicious software, from initial code scaffolding to functional modules.

Researchers have already observed AI-assisted malware development in campaigns linked to the FunkSec group, which deployed Rust-based malware capable of data theft, encryption and process manipulation. Similarly, during the Revenge Hotels campaign in 2025, threat actors used large language models to generate portions of the infector and downloader code.

“We expect AI to remain one of the key factors shaping the threat landscape in 2026, as we already see how it is reshaping attacker workflows and accelerating their operations,” said Sergey Lozhkin, head of the global research and analysis team (GReAT) in the APAC and META regions at Kaspersky. “By lowering the time and cost required to develop and adapt malicious tools, AI allows threat actors to iterate faster and scale their efforts. Defenders should be prepared for quicker shifts in tactics.”

Kaspersky found that threat actors are increasingly integrating AI into different stages of their operations., with LLMs also being used to generate phishing emails and supporting operational content. 

GReAT last week reveals key cyber threat trends for the first half of 2026 at the recent Cyber Security Weekend for the Middle East, Turkiye and Africa region (META).

According to Kaspersky’s telemetry, online threats exploiting vulnerabilities in websites, emails and web services continued to affect millions of users across the META region during the first half of 2026.

Specifically, Kaspersky detection systems stopped 5,7M attacks from various online resources in South Africa. Turkiye recorded the highest percentage of users affected by web-based threats at 22.8%, followed by Kenya (21.2%), Qatar (19.3%), Nigeria (18.4%) and South Africa (17.2%). In contrast, Saudi Arabia, Jordan and Pakistan registered the lowest share of users targeted by web-borne attacks in the region.

Emerging trends shaping cyber threats

In addition to the growing use of AI by cybercriminals, Kaspersky experts identified several trends that organisations should monitor closely:

• AI-driven malware evolution: generative models can rewrite malware in different languages or architectures, making malicious code harder to detect, and faster to deploy at scale.
• Cloud-based data exfiltration: attackers increasingly route stolen data through legitimate cloud and file-sharing services to blend in with normal traffic.
• Ransomware targeting operations: some groups disrupt production and business processes, not just encrypt data, to increase pressure for payment.
• AI agents as persistence mechanisms: some AI agent solutions are granted broad or even full system access. If compromised, attackers could modify the system prompt or the agent’s configuration, for example, causing it to download a payload on every startup.
• Malicious AI skills become a new attack vector: as AI agents gain broader access to enterprise systems, attackers start to exploit compromised skills to manipulate agent behaviour, steal sensitive data, execute unauthorised actions, and establish persistent access. This creates a new layer of risk where trusted AI tools can be turned into powerful mechanisms for cyberattacks.