Artificial Intelligence (AI) is so popular because it has the potential to improve many aspects of our lives, both from a personal and professional perspective. AI is very good at collecting and analyzing data, and large language models (LLMs) can answer a wide range of questions, especially with access to the Internet.
With businesses all around the globe adopting AI, it’s not surprising that cybercriminals are as well. Potential applications of AI for cybercrime have been theorized for as long as the technology has been available. However, this threat has become a reality as attackers increasingly integrate these tools into their workflows.
Claude Weaponized by Cybercriminals
Anthropic, the creator of the Claude LLM chatbot, reported that cybercriminals were using its tools in large-scale hacking campaigns in August 2025. The company commented on how the attackers leveraged Claude to support every stage of the cyberattack lifecycle, ranging from developing malware to suggesting ransom amounts. According to the company, the malware and exploits developed using its tool were designed to target at least 17 organizations, including some government bodies.
How Cybercriminals Use AI
Many businesses are currently exploring AI, trying to determine its potential use cases and how they can automate various tasks and workflows. As the technology and people’s understanding of it improve, AI will become increasingly common and trusted in the workplace.
Cybercriminals are performing this same exploratory process, looking for ways they can eliminate manual processes that consume time and resources and limit the scalability of their attacks. By increasing the volume and effectiveness of cyberattack campaigns, AI has the potential to dramatically improve their profits. And, there are many ways that cybercriminals can and do use it to do so.
Vibe Hacking
Vibe coding is popular because it lowers the barriers of entry into creating your own software. Using an LLM or a specialized AI-enhanced coding tool, anyone can write prompts that generate code in the language of their choice. As a result, someone with limited technical knowledge can create software that runs, even if it’s a mess and isn’t secure.
Vibe hacking takes the same approach and applies it to malware development. Historically, writing good malware was difficult, which led to Ransomware as a Service (RaaS) and similar relationships where groups specialized in gaining access to an organization’s environment do so to deliver another group’s malware for a share of the profits.
Now, with Claude and other LLMs, anyone can write malware that accomplishes their intended goals if they can find a way to bypass guardrails on these systems designed to prevent this. With some carefully crafted prompts, a cybercriminal can create their own zero-day malware customized to a particular target.
Social Engineering Attacks
Social engineering attacks, like phishing, target people rather than software vulnerabilities. If an attacker can trick someone into installing malware or handing over their password, they don’t need to find and exploit a gap in an organization’s digital defenses.
LLMs can be a useful tool for social engineering in several different ways. Some common use cases include:
Target Research: LLMs can use publicly accessible information to build a profile on a target organization and provide information in response to prompts. This could be used to identify a good target in an organization and tailor a phishing email to them by referencing coworkers and projects. Alternatively, attackers could use this profile to identify the maximum ransom amount that a company is likely willing and able to pay.
Phishing Emails: In the past, phishing emails were easily detectable due to spelling and grammatical errors and similar issues. With LLMs, attackers can easily generate a flawless email that is crafted to manipulate their target into doing what the attacker wants.
Job Interviews: On multiple occasions, North Korean operatives have interviewed for and gotten jobs at various companies to steal sensitive data or plant malware. AI can help them to optimize their LinkedIn profiles, automatically apply for jobs, and masquerade as a native coder once hired.
Attack Planning
Just like the average person asks LLMs questions about everything, so do cybercriminals. Attackers have been known to use LLMs to help plan each stage of their attack and to overcome challenges.
For example, an attacker might ask the LLM for tips on how to extract stored passwords from a compromised computer. The LLM could point out common password stores, how to access them, and even provide some code to do so automatically. This level of support dramatically decreases the amount of knowledge a would-be cybercriminal needs to be effective.
Attack Automation
Agentic AI is designed to allow AI to operate autonomously. Instead of receiving prompts and providing answers, autonomous agents will be able to own a complete workflow from end to end. Given a task, they can develop a plan, execute it, and overcome potential challenges.
Agentic AI also has significant promise for cybercriminals, who can use it to automate their attacks. By doing so, they can perform more sophisticated attacks faster and at greater scale. If an attack only takes seconds or minutes to occur, the target has little or no window to prevent it or respond before it's too late.
AI-Enabled Attacks in Web3
Many of the actions described in Anthropic’s report are just as applicable to the Web3 space as Web2. Some ways that attackers can use AI to target Web3 projects include:
Automated security analysis of smart contracts to identify vulnerabilities
Vibe hacking exploits to take advantage of these vulnerabilities
Automating workloads to bridge and launder funds stolen in attacks
Developing phishing emails and social media profiles for social engineering
Introducing malware into common software libraries or “interview tests”
AI promises to increase the scope and sophistication of cyberattacks targeting Web3 projects. Managing the risk of these attacks requires developing and implementing a robust security program that addresses top threats both on-chain and off-chain.
Halborn offers a range of security services designed to support Web3 projects at every stage of development, including Web2 and Web3 security advisory services and smart contract code audits. Get in touch to find out more.