Threat actors are already using AI to accelerate malware development, generate phishing content, automate scripting, and assist decision-making during intrusions. Researchers from Check Point Research argue that the next phase of this evolution will involve AI becoming embedded directly in malware operations rather than simply supporting development. This would allow attackers to reduce operational costs, scale campaigns more efficiently, and enable less experienced operators to conduct sophisticated attacks. To make this possible, researchers have identified mechanisms that could be used by threat actors employing certain AI assistants with browsing or URL-fetch capabilities that can be manipulated into acting as command-and-control (C2) relays, enabling malicious traffic to blend into legitimate enterprise communications and evade detection.
In this scenario, malware sends prompts to an AI service, instructing it to retrieve content from attacker-controlled infrastructure. The AI then returns the response to the compromised system. This method creates a bidirectional communication channel that tunnels victim data out and attacker commands back in. Notably, this process can occur without authentication or API credentials if the service allows anonymous access, reducing the effectiveness of traditional mitigation measures such as key revocation or account suspension. The researchers demonstrated this technique in a proof-of-concept using mainstream AI platforms such as Microsoft Copilot and Grok. By hosting a benign-appearing website and embedding hidden commands within its content, they showed how malware could collect reconnaissance data, encode it in URL parameters, and transmit it through AI prompts. The AI would then return responses containing attacker instructions. Encoding or encrypting data further helps bypass safeguards designed to block malicious requests. This approach can enable stealthy command execution, payload delivery, or ongoing control over compromised systems while avoiding detection. Instead of using APIs, which may be monitored, attackers can embed browser components such as WebView in malicious software. This allows the malware to simulate normal user activity and interact directly with AI services through web interfaces. By blending into legitimate traffic patterns, this technique reduces the likelihood of triggering security controls or rate-limiting mechanisms. Investigators suggest this could enable persistent, adaptive C2 communications that are difficult to identify using traditional network monitoring.
Beyond covert communication, the researchers emphasized the broader implications of AI-driven malware. Future threats may rely on AI to dynamically determine attack strategies, prioritize targets, and adjust behavior based on environmental context. For example, malware could send system details to an AI model to determine whether a host is valuable, identify sensitive data, or detect sandbox environments before activating malicious functionality. This adaptive capability may reduce observable indicators, complicate forensic analysis, and weaken traditional detection methods that rely on static patterns or sandbox behavior. The researchers also outlined a potential evolution toward AI-driven command infrastructures. In this model, AI systems could automatically triage compromised hosts, identify high-value targets, and focus on selective data theft or encryption rather than broad, noisy activity. Such targeted attacks could achieve impact faster while generating fewer detectable signals. These capabilities could be particularly attractive for ransomware operators, espionage actors, and advanced persistent threat groups seeking stealth and efficiency.
