How Hackers Are Using AI and What You Can Do to Stay Safe

By the FutureWarns Cybersecurity Desk · Reviewed against APWG, IBM, Microsoft, ENISA, FBI IC3, and WEF 2025–2026 reporting · Last updated August 2026

Last December, a security team at a mid-size firm watched something odd happen. Phishing emails that used to get caught 96% of the time were suddenly slipping past filters at nearly ten times their normal rate. Nothing had changed in the filters. What changed was who — or what — was writing the emails. Within a single month, AI-generated phishing jumped from 4% to 56% of all attacks tracked by one global threat network. That is not a slow trend. That is a cliff edge.

If you’ve felt like scam emails, calls, and messages are getting harder to spot lately, you’re not imagining it. You’re seeing the early result of hackers adopting the same AI tools the rest of us use for writing emails and editing photos — except they’re using them to impersonate your bank, your boss, and even your own family’s voice.

This guide breaks down exactly how attackers are using artificial intelligence in 2026, with real numbers from the FBI, IBM, Microsoft, and independent researchers — not guesswork. Then it gives you a practical, step-by-step plan to protect yourself, your family, and your workplace. No jargon you can’t follow. No scare tactics without substance.

1. The Problem: AI Has Rewritten the Rules of Hacking

For twenty years, security advice stayed roughly the same: watch for bad grammar, check the sender’s email address, don’t click suspicious links. That advice worked because scams had tells. A phishing email from “your bank” written by someone overseas often had spelling mistakes or awkward phrasing.

Generative AI removed that tell. A large language model can now write a message in perfect, native-sounding English, French, Hindi, or Japanese in under two seconds. It can mimic your company’s tone of voice if it’s fed a few sample emails. It can even write in the specific style of your actual manager, scraped from a LinkedIn post or a leaked email thread.

According to IBM’s 2025 Cost of a Data Breach Report, roughly 1 in 6 breaches now involve attacker use of AI, split mainly between AI-written phishing and AI-generated deepfake impersonation. The World Economic Forum’s Global Cybersecurity Outlook found that 94% of security professionals now consider AI the single biggest driver of change in the threat landscape. That’s not a fringe opinion — that’s near-universal agreement among the people whose job is to watch this space.

2. Why This Matters to You, Personally

You might think, “I’m not a bank or a Fortune 500 company — why would anyone target me?” Here’s the uncomfortable truth: AI has made it cheap to target everyone at once, then let the software figure out who’s worth following up on.

• Individuals: Voice cloning scams — where a criminal calls pretending to be your child or parent in distress — have surged. Researchers at McAfee found that just three seconds of audio is enough to clone a voice with about 85% accuracy. That’s shorter than most people’s voicemail greeting.
• Employees: If you handle invoices, payroll, HR data, or company logins, you are now a direct target for AI-written business email compromise (BEC) scams that look exactly like a request from your CEO.
• Small businesses: Unlike large enterprises, most small businesses don’t have a security team. AI lets one attacker run hundreds of customized attacks a day — a scale that used to require a whole team of scammers.
• Older adults: The FBI’s 2025 Internet Crime Report found that adults aged 60 and over accounted for $352 million of the $893 million in reported AI-related fraud losses — about 39% of the total.

3. How Hackers Actually Use AI (Explained Simply)

Let’s break this into the methods that matter most, in plain language.

3.1 AI-Written Phishing Emails

Old phishing: generic, error-filled, sent to millions of random addresses. New AI phishing: personalized using details scraped from LinkedIn, company websites, and data breaches, written in flawless language, and often generated at massive scale by connecting an AI model to an automated sending tool.

Researchers at Hoxhunt tracked something remarkable: in tests going back to 2023, AI-written phishing was actually about 31% less effective than a skilled human “red team” attacker. By March 2025, that flipped — AI-generated phishing became roughly 24% more effective than expert human attackers. That’s a 55-point swing in about two years.

3.2 Voice Cloning and “Vishing” (Voice Phishing)

An attacker grabs a short audio clip of someone’s voice — from a YouTube video, a podcast, a company earnings call, even a voicemail greeting — and feeds it into an AI voice cloning tool. Minutes later, they can call a relative or a colleague and sound exactly like that person, asking urgently for money or login codes.

One especially alarming case: cloned-voice phishing attacks surged by over 1,600% in a single quarter (Q1 2025 versus Q4 2024) in the United States, according to threat intelligence firm CyberAngel, citing Deloitte’s research.

3.3 Deepfake Video Calls

This is the one that sounds like science fiction but is already happening in boardrooms. In a widely reported 2024 case, an employee at the engineering firm Arup joined a video call with people who appeared to be the company’s CFO and colleagues. Every one of them was an AI-generated deepfake. The employee made 15 separate transfers totaling roughly $25.6 million before anyone realized the whole call was fake.

3.4 AI-Powered Malware and Automated Hacking

AI also helps attackers on the technical side — writing malicious code faster, finding software vulnerabilities automatically, and creating “polymorphic” malware that changes its own code slightly every time it spreads, making it harder for antivirus software to recognize.

3.5 Fake Websites, Chatbots, and QR Codes

AI can now generate a convincing fake version of a bank’s login page, an airline’s customer service chatbot, or a delivery company’s tracking site in minutes — often nearly indistinguishable from the real thing. Combine that with QR code phishing (“quishing”), and you get scams that bypass email filters entirely because the malicious link is hidden inside an image.

3.6 Deepfake Job Applicants and Employment Scams

A newer trend: fraudsters using AI-generated faces and voices to pass video job interviews, aiming to get hired into remote roles with access to company systems or payroll data — sometimes to funnel salaries to hostile states, sometimes simply to plant a foothold for a future attack.

4. The Numbers: How Big Is This, Really?

Numbers help cut through the noise. Here’s a snapshot of verified figures from major 2025–2026 reports.

Note on the numbers above: some widely shared figures online — like claims of “$1.8 billion in voice-cloning losses” — do not trace back to an audited primary source and should be treated with skepticism. We’ve stuck to figures directly attributable to named institutions.

5. Real Cases: When AI-Powered Attacks Succeeded

Case Study 1: The Arup Deepfake Boardroom

An employee at global engineering firm Arup received a message about a “confidential transaction.” Suspicious at first, the employee joined a video call to confirm — and saw what appeared to be the company’s CFO and several colleagues. All were AI-generated deepfakes, built from publicly available video and audio of real Arup executives. Convinced, the employee authorized 15 transfers totaling $25.6 million before the fraud was discovered.

Lesson: Seeing a face on a video call is no longer proof of identity.

Case Study 2: The $220,000 Voice Call

Back in 2019 — years before today’s tools existed — criminals cloned the voice of a German CEO and called a UK-based energy firm’s managing director, instructing an urgent transfer of €220,000. It worked. This case is often cited as the first widely reported AI voice-fraud incident, and it shows the technique isn’t new — it’s just gotten far cheaper and more convincing since.

Case Study 3: Microsoft’s AiTM Wave

Microsoft reported detecting over 10,000 adversary-in-the-middle (AiTM) attacks per month in 2024 — attacks that use automated toolkits (some AI-assisted) to intercept login sessions in real time, defeating standard multi-factor authentication by stealing the session token right after a user approves a login.

6. The Practical Solution: A Layered Defense

No single tool stops every AI-powered attack. What works is layering several simple habits and tools, so that even if one fails, another catches the problem. Think of it as a set of nets stacked on top of each other.

7. Step-by-Step: Protecting Yourself This Week

For Individuals

1. Set up a family “safe word.” Agree on a word or phrase with close family members that a caller must say to prove they’re really them — especially useful against voice-cloning scams targeting “emergencies.”
2. Turn on phishing-resistant MFA (passkeys or a hardware security key) on your email, banking, and social accounts wherever offered.
3. Never act on urgency alone. If a message or call demands immediate action — money, codes, gift cards — hang up and call the person or institution back on a number you already trust.
4. Limit public audio and video of yourself where practical, especially long clear recordings that make voice cloning easier.
5. Use a password manager so a single AI-crafted phishing page can’t harvest a password you reuse everywhere.

For Employees and Businesses

1. Create a verification policy for money transfers. Any request to move funds or change payment details — even from the “CEO” — requires a callback to a known number, no exceptions.
2. Deploy phishing-resistant authentication (FIDO2/passkeys) across the organization, prioritizing finance and IT staff first.
3. Run realistic, updated phishing simulations that reflect AI-quality lures, not outdated templates with typos.
4. Establish a “pause and report” culture where employees are praised, not punished, for flagging suspicious requests — even if it turns out to be a false alarm.
5. Monitor for your own executives’ voices and faces being used in deepfakes; some firms now watermark or monitor for unauthorized use of leadership media.

8. Tools Worth Using

We are not paid to mention any of these tools; they’re listed because they appear repeatedly in independent security research as effective, mainstream options. Always evaluate a tool’s current reviews and pricing before adopting it.

9. Common Mistakes People Make

10. What Happens Next: The Future Outlook

Security researchers largely agree on the direction of travel, even if the exact speed is uncertain:

• AI-vs-AI defense will become standard. Just as spam filters learned to catch spam, expect email and call systems to increasingly use AI to detect AI-generated content in real time.
• Deepfake detection will get harder, not easier, in the short term. Detection tools that hit 96% accuracy in lab conditions currently drop to around 45–50% in messy, real-world conditions — the arms race is far from settled.
• Passwords will keep fading out. Passkeys and biometric-backed authentication are being pushed hard by Google, Apple, and Microsoft precisely because AI has made password-based phishing so effective.
• Regulation will catch up slowly. Expect more disclosure requirements around AI-generated content (like deepfake labeling laws), though enforcement will likely lag behind the technology for years.
• “Verify, don’t trust” becomes the new normal. The core shift isn’t really about spotting fakes — it’s about building habits (callback verification, safe words, phishing-resistant MFA) that work even when the fake is perfect.

The honest, non-alarmist takeaway: this threat is real and growing quickly, but it is also very defendable. The people who fall for these attacks are usually not careless — they’re rushed. Slowing down, even by thirty seconds, is still one of the most effective defenses that exists.

FAQ

Key Takeaways

• AI has made phishing, voice scams, and deepfake fraud faster, cheaper, and far more convincing than before.
• AI-generated phishing surged from 4% to 56% of tracked attacks in just one month in late 2025.
• A voice can be cloned from as little as three seconds of audio.
• Seeing a face on a video call is no longer reliable proof of identity — the Arup case proved that at a $25.6 million cost.
• Phishing-resistant MFA, callback verification, and slowing down before acting are still the most effective everyday defenses.
• Most reported figures likely understate the true scale, since underreporting remains common across all fraud categories.

Sources and Further Reading

This article draws on primary and institutional research, including: IBM Cost of a Data Breach Report 2025; FBI Internet Crime Complaint Center (IC3) 2025 Annual Report; World Economic Forum Global Cybersecurity Outlook; Microsoft Digital Defense Report 2025; Gartner 2025 security-leader survey; Hoxhunt Phishing Trends Report 2026; ENISA Threat Landscape 2025; Deloitte Center for Financial Services research; McAfee voice-cloning research; and public reporting from CrowdStrike and the Financial Times on the Arup incident. Readers are encouraged to consult these primary sources directly for the fullest context.