AI Accelerates Cyberattacks: Microsoft Warns About Zero-Day Vulnerabilities and Custom Malware

Microsoft: attackers exploit AI more than defenders

Microsoft has revealed that hackers are exploiting artificial intelligence faster than security teams, accelerating the discovery of vulnerabilities, malware development, and post-compromise activities. This technological gap is detailed in the 2026 Digital Defense Report, which analyzes the impact of AI on cybersecurity operations.

Quick Response

AI reduces costs and the need for specialized skills

AI is lowering the costs and the need for advanced skills to discover and exploit vulnerabilities. This is creating a period of several years in which the number of known but unpatched vulnerabilities will increase significantly. Well-prepared and funded adversaries could accumulate a large number of zero-days.

Vulnerabilities and delayed patching times

Microsoft emphasizes that remediation is inherently slower than discovery, especially since many systems lack robust unit and integration testing. This means organizations will have less and less time to patch exposed systems before they are exploited.

Customized malware and accelerated post-compromise activities

Attackers are using AI to generate customized malware and accelerate post-compromise activities such as data exfiltration, secret discovery, and lateral movement, reducing times from days to minutes.

Automation of attack chains

AI allows attackers to automate larger portions of attack chains with limited human interaction. This is democratizing access to capabilities previously reserved for more experienced hackers.

State actors exploit AI for real operations

State actors have already begun using AI in real operations. Chinese hackers use it for vulnerability research, while Russians use "vibe coding" and AI-generated tools to enhance their attacks.

North Korea: AI for social engineering and malware

North Korean IT workers use AI for identity development, social engineering, and maintaining access to organizations. Other North Korean groups use it to create malware and manage attack infrastructures.

Konni and advanced phishing operations

The North Korean hacker group Konni has used AI-generated PowerShell malware to target developers and blockchain engineers. These attacks exploit AI to create more convincing and fraudulent phishing.

Operations of fake IT workers with deepfakes

BleepingComputer reported North Korean operations in which hackers posed as IT workers, using AI-generated deepfake videos to create convincing identities and obtain jobs at Western companies.

Limited autonomy in real attacks

Microsoft warns that, although AI is accelerating the creation and execution of attacks, most real campaigns still require human intervention for target selection and management of the most complex parts of the attack.

Impact on corporate security strategies

This technological gap requires organizations to review their incident response strategies and consider implementing MDR services to address the increased speed of attacks.

The importance of cyber insurance

Given the increased risk, companies should consider purchasing cyber risk policies to cover potential damages resulting from AI-accelerated attacks.

The need for more frequent security audits

Organizations should increase the frequency of security audits to identify and correct vulnerabilities before they can be exploited by attackers.

The impact on NIS2 and DORA compliance

This scenario requires greater attention to NIS2 compliance and digital operational resilience according to the DORA regulation, as organizations must be able to respond quickly to ever-faster threats.

The importance of a SOC as a Service

Given the increased complexity and speed of attacks, companies may benefit from implementing a managed Security Operations Center to monitor and respond to threats in real time.

The adoption of zero trust architectures

Organizations should consider adopting zero trust architectures to limit access to sensitive data and reduce the potential impact of attacks.