On March 6, 2026, Microsoft Threat Intelligence published an analysis documenting how threat actors are embedding artificial intelligence into their operational workflows across the full cyberattack lifecycle. The report distinguishes between AI used as an accelerator and AI used as a weapon, and surfaces early signals of a transition toward agentic AI use that could materially complicate detection and response. The observations are grounded in tracked activity by North Korean state-aligned actors, primarily Jasper Sleet and Coral Sleet (formerly Storm-1877), whose AI-enabled remote IT worker campaigns represent one of the clearest current examples of AI-assisted persistent threat operations at scale.
AI as a Force Multiplier Across the Attack Lifecycle
Microsoft's central finding is that most observed malicious AI use centers on language models for producing text, code, and media. Threat actors leverage generative AI to draft phishing lures, translate content, summarize stolen data, generate and debug malware, and scaffold scripts or infrastructure. In each case, AI reduces technical friction and accelerates execution while human operators retain control over objectives, targeting, and deployment. The diagram below, published by Microsoft Threat Intelligence, maps observed AI use across the six stages of the attack lifecycle.
During reconnaissance, threat actors use LLMs to research publicly disclosed vulnerabilities and identify exploitation paths, surface EDR bypass techniques, and develop convincing digital personas aligned to specific job markets. Jasper Sleet has been observed prompting AI platforms to extract role-specific language from job postings and generate culturally appropriate name and email format lists to support fraudulent identity construction at scale.
During resource development, actors use GAN-based techniques to automate look-alike domain generation by training models on legitimate domain datasets, producing outputs that are increasingly difficult to distinguish from real infrastructure using pattern-based detection. Coral Sleet has been observed using development platforms to rapidly create and manage high-trust web infrastructure for staging, testing, and C2 operations.
During initial access, AI-assisted phishing lures are becoming more effective by adapting content to a target's native language with native fluency, eliminating the grammatical and phrasing errors historically used as detection signals. Jasper Sleet has used the application Faceswap to insert faces into stolen identity documents and generate headshots for resumes, with the same AI-generated photo reused across multiple personas with slight variations. Voice-changing software has been observed in use during remote job interviews to mask accent and pass as Western candidates.
AI-Assisted Malware Development
Microsoft Threat Intelligence has identified characteristics within observed malware code consistent with AI-assisted creation. Coral Sleet's OtterCookie payload samples contain emoji-based visual markers within code paths (green check marks for successful requests, red cross marks for errors) and conversational inline comments describing execution states and developer reasoning. These stylistic artifacts, which include overly descriptive function and variable naming, over-engineered modular abstraction, and inconsistent naming conventions across related objects, are becoming a useful indicator of AI-generated or AI-assisted code in threat actor tooling.
Coral Sleet has also been observed using agentic AI tools to support a fully AI-enabled lure development workflow spanning fake company website creation, remote infrastructure provisioning, and rapid payload testing. The actor has further demonstrated new payload generation by jailbreaking LLM software to bypass built-in safeguards and accelerate operational timelines.
Post-Compromise AI Use
Following initial compromise, threat actors use AI primarily as an on-demand research assistant to analyze unfamiliar victim environments and reduce the time and expertise required for post-compromise decision-making. Observed uses span discovery (summarizing configuration data and directory structures to identify high-value assets), lateral movement (analyzing trust relationships to prioritize viable movement paths), privilege escalation (interpreting error messages from failed escalation attempts and researching compatible techniques), and collection and exfiltration (translating high-level objectives into structured queries, summarizing large file and email datasets, and assessing data value to minimize transfer volume and detection risk). At the impact stage, AI is used to summarize and categorize exfiltrated data, inform extortion strategy, determine ransom amounts, and craft tailored communications including ransom notes and automated victim-facing chatbots.
Emerging Trends: Agentic AI and AI-Enabled Malware
Microsoft reports early signals of a transition toward agentic AI use by threat actors, where models are integrated into workflows that pursue objectives iteratively, including planning steps, invoking tools, evaluating outcomes, and adapting without continuous human prompting. Large-scale use has not yet been observed, constrained by reliability and operational risk, but proof-of-concept experiments point toward potential semi-autonomous workflows for phishing campaign refinement, infrastructure management, and OSINT monitoring.
A separate emerging trend involves AI-enabled malware that embeds or invokes language models during execution rather than relying solely on AI during development. Early malware families documented in public reporting can dynamically generate scripts or adapt behavior at runtime, representing a shift away from fully pre-compiled tooling. Microsoft characterizes these efforts as experimental and uneven but views them as an early signal of future AI integration into malware design.
Microsoft researchers have also observed a growing trend of organizations using AI recommendation poisoning to bias AI assistant memory toward specific sources or products. While currently limited to enterprise marketing use cases, this technique represents an emerging class of memory poisoning attacks that threat actors could misuse for influence operations or to manipulate AI-driven decision processes.
Jailbreaking and Safety Control Subversion
Threat actors actively experiment with techniques to bypass AI safety controls, including reframing prompts, chaining instructions across multiple interactions, and role-based jailbreak prompts designed to coerce models by asserting trusted context. Microsoft documents example prompts of this type, such as instructing a model to respond as a trusted cybersecurity analyst or framing a request within an educational context to extract otherwise restricted technical guidance. These techniques are not theoretical: Coral Sleet has been observed using jailbreaking to generate malicious code that bypasses LLM safeguards in an operational context.
Assessment
The Microsoft Threat Intelligence report is the most comprehensive public documentation to date of AI operationalization by state-aligned threat actors. The North Korean remote IT worker campaigns (Jasper Sleet, Coral Sleet) represent a particularly mature and instructive case: AI is used not merely as a technical tool but as an enabler of sustained human deception at scale, supporting fraudulent employment, long-term corporate access, and persistent low-and-slow operations that are difficult to attribute and attribute correctly. The combination of AI-assisted persona construction, voice modulation, AI-assisted malware development, and post-compromise AI-assisted data triage constitutes an integrated operational workflow that materially changes the resource requirements and skill floor for sustained access operations. For defenders, the shift toward AI-assisted tradecraft means that linguistic quality and technical sophistication are increasingly unreliable indicators of attacker capability or effort, and that behavioral and contextual detection signals require renewed emphasis over static content analysis.
This article is published for threat intelligence purposes. IntelFusions is not affiliated with any threat actor group. Claims described herein have not been independently verified unless explicitly stated. Primary source: Microsoft Threat Intelligence, March 6, 2026.