Zscaler published an analysis on October 16 examining how cybercriminals are applying generative AI to social engineering, data discovery, and malware development. The report was authored by Phil Hagen, principal security researcher at the company.
The document describes broad techniques rather than identifying any named malware family or confirmed campaign. Its central theme is the speed with which malicious scripts can now be created and revised, and the resulting challenges for defenders.
Traditional detection compares files and network traffic against previously known patterns. When attackers rapidly alter code while maintaining the same outcome, these comparisons become far less reliable. Rules built from older samples lose value against newly generated code that has not yet been catalogued.
The report explicitly states that the observed activity does not demonstrate fully autonomous self-mutating malware. What Zscaler documented is rapid human-driven creation and revision, not an automatic mutation mechanism that activates on every execution.
A secondary effect is the loss of a classic detection signal. Messages produced by language models contain no spelling or grammar errors that once flagged phishing attempts. Some of these messages persuade users to install remote monitoring and management software. Once installed, attackers gain control of the system and can move laterally using legitimate tools.
In ransomware operations, the interval between initial access and data theft followed by encryption has shortened. Smaller groups now possess development capabilities comparable to those of larger organizations, reducing the value of unique tooling as an indicator of attacker identity or resources.
Zscaler recommends that defenders evaluate program behavior rather than relying primarily on matches to known samples.
