PROMINENT threat actors are curbing their use of artificial intelligence in cyber campaigns, according to Proofpoint researchers. In a briefing shared with Dark Reading, the TA4903 operation—previously a sophisticated credential-phishing and business email compromise group—has shifted to using AI across its entire attack chain, including social engineering, targeting, and credential harvesting.
Yet the quality of their phishing remains inconsistent, with vibe-coded control panels, exposed Cloudflare deployments, and poorly rendered lures. Researchers say AI is increasing noise rather than sophistication, and several state-sponsored actors appear to be abandoning AI-driven campaigns in favour of lower-cost, higher-volume methods. The overall picture is that AI-assisted attacks are not delivering the hoped-for advance; rather, they are yielding muddier, more detectable operations.
The report also highlights moves by nation-state actors. North Korea’s Kimsuky allegedly used AI agents and large language model infrastructure to automate spear‑phishing content for Ukraine, but the result was a disjointed mix of targets and flawed malware, illustrating that AI can degrade operation quality when misapplied.
Bitdefender’s visibility into Pakistan’s APT36 (Transparent Tribe) shows a similar trend: a shift to vibeware—disposable, polyglot files generated with AI—yet analysts question the practical value when the tooling does not reliably perform data exfiltration or other core functions. Overall, experts emphasise that the most advanced groups remain cautious about AI in cyber espionage; for now, the most notable AI-driven activity appears to be noisy and error-prone rather than a paradigm shift in threat capability.