How AI-Generated Malware Works: A Deep Dive into Its Structure

Exploring how AI reshapes malware characteristics and challenges cybersecurity professionals.

AI-Generated Code: Patterns and Anomalies

Lindsay Kaye, a senior threat intelligence professional at HUMAN Security, detailed how artificial intelligence is reshaping the characteristics of malicious code and the challenges it introduces for cybersecurity professionals. Kaye emphasized that while AI-generated malware often exhibits distinct markers during initial analysis, the decompilation process can obscure many of these indicators, complicating forensic investigations.

Decompilation Process

Scripts or code generated by AI tools frequently display structured formatting, such as consistent commenting practices, standardized logging messages, and occasional use of emojis. These elements, while common in legitimate software development, are uncommon in manually crafted malware. However, when code is decompiled—such as in the case of compiled binaries—these features are typically lost, as decompilers cannot reconstruct original comments or formatting.

Structured Approach

Kaye noted that AI-driven code often follows established software design principles, such as modular organization and clean syntax. This structured approach can make AI-generated malware appear more sophisticated than manually written variants. However, she cautioned that not all code with these traits is AI-generated, as human developers may also adopt similar practices.

Persistent Traditional Tactics

Kaye pointed out that legacy code snippets, such as placeholder names like “MyWindowClass,” continue to appear in modern malware, whether manually copied or generated by AI. Additionally, obfuscation methods like O-MVLL toolkits and custom encryption techniques are still widely used to evade detection. These methods, though effective, do not inherently indicate AI involvement, making it difficult to determine the origin of a given sample.

Accelerated Threat Cycles and Patching Challenges

The integration of AI into malware development has compressed the timeline between vulnerability discovery and exploitation. Kaye cited the PHP2Shell RCE vulnerability as an example, where the rapid availability of exploit tools could lead to widespread damage if malicious actors acted before patches were deployed. This trend forces security teams to address vulnerabilities at an accelerated pace, complicating patch management due to dependencies, compatibility concerns, and operational downtime.

AI’s Role in Criminal Economics

Kaye discussed how AI enhances the scalability of cybercriminal operations. For instance, AI-powered tools are used to generate phishing content, automate data analysis from stolen datasets, and even verify the validity of stolen credentials. These capabilities reduce the effort required for large-scale fraud, such as account takeover campaigns or streaming ad fraud. However, she noted that pricing for stolen data remains largely influenced by supply and demand rather than AI-specific factors.

Collaboration and Information Sharing

Kaye argued that traditional indicators of compromise (IOCs) like hashes and domains remain more actionable than abstract “AI abuse indicators.” She emphasized the value of existing frameworks, such as MITRE’s AI Incident Sharing Initiative, which documents real-world AI-driven attacks and provides context for defenders. Kaye stressed that collaboration between platform providers and threat intelligence teams is critical to understanding how AI tools are weaponized.

Human Oversight in AI-Enhanced Research

Kaye’s team maintains strict human review protocols. AI is used to streamline tasks like data summarization, IOC extraction, and detection rule development, but final conclusions require manual validation. This approach ensures that contextual insights and domain expertise are not overlooked, particularly when AI-generated outputs may lack nuance or accuracy.

About Author

Anuj

See author's posts