AI as tradecraft: How threat actors operationalize AI

Threat actors are using AI and language models as operational tools to speed up cyberattacks across all stages, from creating phishing emails to generating malware code, while human attackers maintain control over targeting and deployment decisions. Emerging experiments with agentic AI (where models make iterative decisions with minimal human input) suggest attackers may develop more adaptive and harder-to-detect tactics in the future. Microsoft reports disrupting thousands of fraudulent accounts and partnering with industry to counter AI-enabled threats through technical protections and responsible AI practices.