TLDR: A recent report by Intel 471 indicates that while AI tools are being leveraged by cybercriminals to refine social engineering tactics, particularly in crafting more convincing phishing content and localization, they have not yet fundamentally transformed the broader hacking landscape. This is attributed to the high computational demands of AI, challenges in integrating these tools into existing hacking infrastructure, and the persistent effectiveness of simpler, established methods.
A new report from cybersecurity firm Intel 471, released on October 8, 2025, reveals that artificial intelligence (AI) is playing an evolutionary, rather than revolutionary, role in the current cybercrime ecosystem. While AI is undeniably assisting threat actors in enhancing social engineering campaigns, its impact on core hacking methodologies remains limited.
The report highlights that cybercriminals are not yet fully overhauling their attack techniques to incorporate AI. Researchers noted, “Although AI is often touted as a game-changer for the social engineering landscape, in the context of phishing, most threat actors still rely on phishing-as-a-service platforms and kits and use AI primarily for content drafting and localization, not for true automation or innovation.”
Several key factors contribute to AI’s current evolutionary status in cybercrime. Intel 471 cited three primary reasons: significant computational limitations, the inherent difficulty of seamlessly integrating AI into existing hacking tools, and the continued, proven effectiveness of current, less complex tactics. The process of embedding AI into cyberattacks—which involves training or configuring models, automating them within an attack infrastructure, integrating them with delivery systems, and designing methods to evade detection—is time-consuming and detracts from the immediate profitability sought by cybercriminals. Consequently, many prefer ‘plug-and-play’ phishing kits, which are easier and faster to deploy and have a well-established track record of success.
Despite these limitations, generative AI is proving valuable in specific areas of social engineering. Cybercriminals are utilizing AI to create sophisticated audio deepfakes capable of impersonating executives, establishing AI-powered call centers to automate scams, and generating video deepfakes to deceive individuals in contexts like job interviews. The report also detailed the emergence of AI voice bots designed to solicit multi-factor authentication (MFA) codes and credit card numbers from victims, with one such service boasting a 10% success rate. One observed call center reportedly employed three different AI models, including one from Google and another from OpenAI.
However, the widespread operational adoption of AI-driven tools in underground markets is still in its nascent stages. Intel 471 found “limited evidence of AI-driven tools circulating in underground markets,” and discussions among threat actors “rarely reference the operational use of generative AI.”
Also Read:
- Report: AI Emerges as Primary Channel for Enterprise Data Exfiltration, Outpacing Traditional Risks
- Generative AI Amplifies Russian Disinformation Campaigns, Warns Expert David Colon
The firm concluded that the practical integration of AI technology by cybercriminals is still in its infancy. Widespread adoption is anticipated to depend on a reduction in model hosting costs and the development of advanced ‘AI kits’ that rival the popularity and ease of use of today’s phishing-as-a-service offerings. Looking ahead, Intel 471 predicts an increase in deepfake impersonation calls targeting business leaders and a surge in AI-fueled disinformation campaigns, particularly during critical periods such as elections, geopolitical flashpoints, and social justice debates.
