Mobile-Menu

Cybersecurity AI-Powered Attacks Overcome Defenses

From HP | Translated by AI 2 min Reading Time

Related Vendor

Taiwan Machine Tool & Accessory Builders' Association (TMBA)

According to the latest Threat Insights Report from HP, attackers are using AI to accelerate their campaigns. Although these attacks are of low quality, they bypass companies' defenses.

The HP Wolf Security Report shows: Attackers use AI for speed, modularity and automation, while the quality of campaigns is low.(Image: Picture: Pixabay)
The HP Wolf Security Report shows: Attackers use AI for speed, modularity and automation, while the quality of campaigns is low.
(Image: Picture: Pixabay)

The HP Threat Report analyzes real-world cyber attacks. It helps organizations keep up with the latest techniques attackers are using to remain undetected and penetrate PCs in the rapidly changing cybercrime landscape.

From Vibe Hacking to Flat-Pack Malware

Based on millions of devices running HP Wolf Security*, HP threat researchers have identified the following campaigns:

  • Vibe hacking scripts with redirects from Booking.com: Attackers use AI to generate prefabricated infection scripts—known as vibe hacking. In this way, they automate the spread of malware. In one campaign, for example, a link in a fake invoice PDF triggers a silent download from a compromised website. To further increase credibility, victims are then redirected to trusted platforms such as Booking.com.
  • Flat-pack malware allows campaigns to be created more quickly: Threat actors assemble attacks using inexpensive, off-the-shelf malware components that they are likely to purchase from hacker forums. While the lures and final payloads change, attackers repeatedly use the same intermediate scripts and installers. This allows campaigns to be quickly created, customized and scaled with minimal effort. Remarkably, this is not the work of a single threat group, but multiple, independent actors using the same building blocks.
  • Malware hidden in fake Teams installer "Piggyback" attack: Attackers spread malware using search engine poisoning and malicious ads promoting fake Microsoft Teams websites. Victims download a malicious installation package that hides the "Oyster Loader" malware. The malware has been injected into the Teams installation process so that the real app is installed while the infection goes unnoticed. Cyber criminals thus gain control of the device via the back door.

About the HP Wolf Security Report

HP Wolf Security gains insight into the latest techniques used by cybercriminals by isolating threats that have escaped detection tools on PCs—but malware can still safely detonate in secure containers. To date, HP Wolf Security customers have clicked on over 60 billion email attachments, web pages and downloaded files with no reported breaches. The report examined data from October through December 2025 and details how cybercriminals continue to diversify their attack methods to evade security tools without breaches being reported.

  • At least 14 percent of email threats identified by HP Sure Click bypassed one or more email gateway scanners.
  • Executable files were the most popular type of transfer (37 percent), followed by .zip (eleven percent) and .docx (ten percent).

Subscribe to the newsletter now

Don't Miss out on Our Best Content

By clicking on „Subscribe to Newsletter“ I agree to the processing and use of my data according to the consent form (please expand for details) and accept the Terms of Use. For more information, please see our Privacy Policy. The consent declaration relates, among other things, to the sending of editorial newsletters by email and to data matching for marketing purposes with selected advertising partners (e.g., LinkedIn, Google, Meta)

Unfold for details of your consent

Related content