AI Makes Getting In Easy. What Happens Next Is the Real Problem
AI didn’t just improve phishing, it changed the economics of intrusion. With 82% of attacks now malware-free, adversaries rely on stolen credentials and legitimate IT tools to move undetected.
Attackers don't need malware anymore.
CrowdStrike's 2026 Global Threat Report dropped a stat that should keep every security leader up at night: 82% of all threat detections in 2025 were malware-free (CrowdStrike). No custom payloads. No sketchy executables. Just stolen credentials and your own IT tools turned against you.
That number was 40% in 2019. We're watching a fundamental shift in how attacks work and most security architectures haven't caught up.
AI lowered the barrier. Way down.
The underground market for malicious AI tools exploded in late 2024. Researchers at CATO Networks found two new WormGPT variants actively selling on BreachForums (CSO Online). One's built on Mistral's Mixtral model, distributed via Telegram for €60. The other wraps xAI's Grok with jailbreak prompts.
These aren't sophisticated custom models. As CATO researcher Vitaly Simonovich put it: "threat actors skillfully adapting existing LLMs."
GhostGPT showed up in November 2024, selling on Telegram at $50/week. Testing confirmed it could spit out convincing DocuSign phishing templates with zero content filters. FraudGPT continued racking up 3,000+ sales at $200/month (Dark Reading).
The impact shows up in the numbers. SlashNext documented a 4,151% increase in phishing attacks since ChatGPT launched (Yahoo Finance). Credential phishing specifically surged 703% in the second half of 2024.
Here's the kicker: AI-generated phishing emails achieve a 54% click-through rate compared to 12% for traditional human-crafted attempts (Hoxhunt). The grammatical errors and awkward phrasing that trained employees to spot fakes? Gone.
FunkSec proved AI makes up for lack of skill
The FunkSec ransomware campaign showed exactly what democratized attack tools enable. The group emerged in December 2024 and claimed 85-103 victims in a single month, more than any other ransomware group that month (Check Point Research).
Check Point confirmed the likely Algeria-based operator used AI-assisted development despite "apparent lack of technical expertise." The developer told researchers directly: "I am a developer and not a coder" (The Record).
Code comments appeared in perfect English despite the author's basic English proficiency elsewhere. AI filled the gaps.
But initial access is only half the story
Getting in has never been the hard part for sophisticated attackers. Staying in, moving laterally, and achieving objectives without triggering alerts, that's where the real tradecraft lives.
And that's where Living Off The Land comes in.
Sophos's December 2024 Active Adversary Report documented a 51% increase in LOTL binary abuse year-over-year (Sophos). They identified 187 unique Microsoft LOLbins being weaponized. Remote Desktop Protocol appeared in 89% of nearly 200 incident response cases, making RDP the single most abused legitimate tool in modern attacks.
This matters because these aren't malicious tools. They're your tools. PowerShell. PsExec. AnyDesk. The same utilities your IT team uses every day.
EDR can't flag what it's programmed to trust.
The ransomware playbook is now pure LOTL
Black Basta hit over 500 organizations in 2024, including 12 of 16 critical U.S. infrastructure sectors (CISA). Their May 2024 Ascension Healthcare attack disrupted 140 hospitals across 19 states, forcing staff onto paper systems.
Their toolkit reads like an IT administrator's workstation: AnyDesk, Microsoft Quick Assist, ScreenConnect, TeamViewer, PsExec, PowerShell, WMIC, Mimikatz, and Rclone for cloud exfiltration.
Akira ranked as the most frequent ransomware for six consecutive quarters according to Coveware data (Picus Security). A September 2024 attack timeline showed the speed: defense evasion at 11:40, credential dumping by 11:44, persistent admin account creation at 11:51, ransomware execution at 12:01.
Twenty minutes from disabling defenses to encryption. Using your own tools.
| Threat Group | Key LOTL Tools | Notable 2024 Incidents |
|---|---|---|
| Black Basta | Quick Assist, AnyDesk, PsExec, Mimikatz, Rclone | Ascension Healthcare (140 hospitals) |
| Akira | PowerShell, PsExec, Mimikatz, comsvcs.dll | Stanford, Nissan Australia, Tietoevry |
| LockBit 3.0 | WMI, PowerShell, mshta.exe, Task Scheduler | CDK Global ($25M ransom demand) |
| Scattered Spider | ScreenConnect, TeamViewer, Tactical RMM, Pulseway | Qantas (5.7M customers), WestJet |
Nation-states proved LOTL works at scale
Volt Typhoon maintained undetected access to U.S. critical infrastructure for over five years (Microsoft). FBI Director Christopher Wray called them "the defining threat of our generation."
The Chinese state-sponsored group relied "almost exclusively on living-off-the-land techniques and hands-on-keyboard activity", PowerShell, WMI, vssadmin, and other legitimate tools. They proxied traffic through compromised SOHO routers from ASUS, Cisco, D-Link, and NETGEAR, performing targeted log deletion to eliminate forensic evidence.
Five years. Using your own tools. No malware to detect.
The convergence problem
Here's what makes this moment different: AI-generated phishing defeats email security at the front door. LOTL techniques evade endpoint detection once inside.
Traditional security architecture assumes you'll catch something along the way. A signature. An anomaly. A mistake.
CrowdStrike documented the fastest adversary breakout time at just 51 seconds, the time from initial access to lateral movement (CrowdStrike). The average dropped to 48 minutes.
You can't staff a SOC to respond faster than that.
The math doesn't work anymore
Detection-based security assumes malware will be present to detect. It assumes humans will make detectable mistakes. Neither assumption holds in 2026.
When AI eliminates the grammatical errors that trained employees to spot phishing, and when adversaries use the same PowerShell commands as your legitimate administrators, you're playing a game you cannot win through detection alone.
The 79% malware-free intrusion rate means EDR tools designed around malware signatures miss the majority of modern attacks by design.
The organizations that survive this shift won't be the ones with better detection. They'll be the ones that prevent malicious actions from succeeding in the first place, even when the attacker is already inside, even when they're using legitimate tools.
That means controlling what applications can run, where they can run, and what they're allowed to do. Not trying to distinguish good PowerShell from bad PowerShell after the fact.
The question isn't whether you'll be targeted. The question is whether your architecture is designed for a world where getting in is the easy part.
Want to keep up with how modern attacks actually work? Subscribe to the MagicSword newsletter for practical research, real-world attack tradecraft, and prevention-focused intelligence from the team tracking abused tools every day.
If you want to see how this intelligence turns into real blocking, stopping abused tools before they execute, you can book a demo here.
Written by
Jose Hernandez
Threat Researcher
Jose Enrique Hernandez formed and served as the Director of Threat Research at Splunk. Jose is known for creating several security-related projects, including: Splunk Attack Range, Splunk Security Content, Git-Wild-Hunt, Melting-Cobalt, lolrmm.io and loldrivers.io. He also works as a maintainer to security industry critical repositories such as Atomic Red Team and lolbas-project.github.io.
