Cybercriminals Are Now Weaponizing GenAI: CrowdStrike Unmasks a Disturbing Trend

Cybercrime has entered a dangerous new phase — one powered by artificial intelligence. From phishing to fake job applicants, malicious actors are increasingly turning to generative AI to scale, automate, and amplify their attacks. CrowdStrike’s latest 2025 Threat Hunting Report reveals just how deeply GenAI is transforming the cyber threat landscape.

AI-Powered Attacks on the Rise: A Dangerous Shift in Cybercrime Tactics

CrowdStrike’s newly published 2025 Threat Hunting Report reveals an unsettling reality: cybercriminals, from sophisticated nation-state actors to low-level scammers, are now fully integrating generative AI (GenAI) into their arsenal. This isn’t just about phishing emails anymore — attackers are now using GenAI for everything from automated malware creation to deepfake interviews.

In just the first half of 2025, voice phishing (vishing) incidents have already surpassed those recorded in all of 2024. Simultaneously, hands-on keyboard intrusions — direct, manual access breaches — have risen by 27% year-over-year. This data underscores a massive acceleration in both attack frequency and sophistication.

CrowdStrike’s report details how GenAI is now supporting three major threat areas:

Social engineering: AI helps generate convincing phishing emails, fake online personas, and forged documents that pass superficial checks.
Technical operations: Attackers use GenAI to develop malware, discover vulnerabilities, and offer real-time technical support for their intrusions.
Information warfare: GenAI is being deployed to produce misinformation, create propaganda in multiple languages, and even mimic credible media platforms.

In one striking example, adversaries exploited a Langflow AI vulnerability (CVE-2025-3248) to execute unauthenticated remote code, targeting a widely used AI agent development tool. CrowdStrike stresses that threat actors no longer treat AI as a peripheral gadget — they see it as core infrastructure.

A major spotlight in the report is on Famous Chollima, a North Korea-linked cyber group that has embraced GenAI for job fraud. This group infiltrated companies by posing as remote IT workers, with AI-generated résumés, cover letters, and even deepfake video interview tech masking their identities. Once hired, they used tools like Microsoft Copilot and VSCodium to handle real work — often juggling 3–4 jobs at once to exfiltrate data or gain deeper system access.

CrowdStrike attributes their success to AI-enhanced workflows that optimize each step of the employment scam — from identity creation to task execution. To counter such sophisticated threats, organizations must rethink security entirely. Suggestions include real-time deepfake detection during interviews, stronger endpoint and geolocation protections, and training for HR and IT departments on AI-era infiltration tactics.

Ultimately, GenAI isn’t replacing traditional attacks — it’s supercharging them. CrowdStrike emphasizes that both well-funded and low-budget threat actors are now leveraging AI tools to improve scale, speed, and stealth.

What Undercode Say:

The CrowdStrike report is a wake-up call, not just for cybersecurity teams but for every organization embracing AI in their daily operations. What’s most alarming is that GenAI is being adopted across the entire threat actor spectrum — from top-tier nation-state operations to decentralized cybercrime syndicates and lone-wolf scammers. The democratization of GenAI tools means that you no longer need elite technical skills to become a dangerous adversary.

Here’s what stands out from the report and why it matters:

The AI-as-infrastructure concept flips the traditional security model. AI tools like Langflow are now targets themselves, creating new vectors of exploitation. Organizations must consider these systems as critical assets and harden them accordingly.

Social engineering is entering a post-Turing Test era. With GenAI capable of producing near-human-level language, the traditional warning signs of phishing — grammar mistakes, awkward phrasing — no longer apply. In fact, AI-generated phishing is often more polished than messages written by native speakers.

Famous Chollima’s tactics demonstrate that trust models are crumbling. The notion that remote employees are less risky or that good performance equals legitimacy is being exploited. Deepfake interviews and AI-generated documentation blur the lines between genuine and malicious actors.

Multilingual misinformation campaigns using GenAI could amplify nation-state disinformation efforts, especially during geopolitical events or elections. AI doesn’t just produce content; it produces content at scale, in the target’s native language, and tailored to cultural nuances.

Job fraud via AI is the new insider threat. The most chilling element is that these infiltrators do real work. They don’t raise red flags because they’re not sabotaging systems immediately — they’re gathering, learning, embedding.

We’re entering a phase where the cyber kill chain is being compressed, streamlined, and made invisible — thanks to AI. Organizations must pivot from traditional security strategies to AI-aware defenses, including anomaly detection in workflow patterns, real-time identity verification, and AI threat hunting integrated into every digital layer.

The key takeaway? AI is no longer just a tool for defenders. It’s now a weapon for attackers. And unless we evolve faster than they do, the gap will only widen.

🔍 Fact Checker Results:

✅ GenAI was used in real job application fraud schemes, including by North Korea-linked actors
✅ CrowdStrike confirmed an increase in AI-enabled phishing and deepfake tech in threat operations
✅ Langflow AI vulnerability CVE-2025-3248 was actively exploited in 2025

📊 Prediction:

As GenAI continues to evolve, expect cybercriminals to launch autonomous, AI-driven attack chains — systems capable of identifying vulnerabilities, crafting exploits, delivering payloads, and generating real-time propaganda without human intervention. By late 2026, AI may be used to create entirely synthetic cyber operations, complete with fake victims, false flags, and fabricated digital trails. If cybersecurity doesn’t adopt AI-native defense models, we could see the rise of invisible cyberwars fought between algorithms — while humans remain oblivious.