Hackers Use AI-Generated Code to Obfuscate Payloads and Bypass Traditional Defenses

Hackers are using AI-generated code to obfuscate payloads and bypass traditional defences, with defenders noting that AI-assisted threats remain detectable when analytic methods adapt. On 18 August 2025, according to Microsoft Threat Intelligence, a targeted phishing campaign exploited a compromised small business email account to distribute credential-stealing emails, where the attachment named “23mb – PDF- 6 pages[.]svg” masqueraded as a PDF despite its SVG extension.

The SVG embedded JavaScript would, if opened, reconstruct a phishing landing page for credential harvesting, while the code’s over-engineered, business-analytics terminology and data-analytics attributes signalled AI-generated origins. Microsoft Defender for Office 365 thwarted the campaign by analysing infrastructure, behaviour and message context rather than focusing solely on payload code.

Indicators included self-addressed emails with BCC recipients, SVGs named like PDFs, redirects to domains linked to known phishing content, and generic obfuscation patterns alongside network behaviours such as session tracking and fingerprinting. To strengthen defences, organisations are urged to implement Defender settings, enable ZAP, and deploy phishing-resistant authentication alongside broader AI-driven analytics to focus on attack patterns and infrastructure traits. according to Microsoft Threat Intelligence