Cybercriminals are exploiting artificial intelligence to launch increasingly sophisticated attacks, resulting in a significant financial impact in the United States. In 2024, social engineering losses reported to the FBI reached $16.6 billion in the US, marking a 33% increase over the previous year.

This surge reflects a new era of cybercrime where AI enhances attackers' ability to deceive and compromise targets, affecting businesses and individuals alike.

What the Records Show

Security researchers at ANY.RUN identified 1,258 public sandbox analyses between April and October 2026, linked to campaigns impersonating popular AI products, demonstrating a deliberate strategy to exploit the “AI gold rush” for illicit gains. These campaigns often involve "ClickFix attacks," which use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware and stealing credentials.

Attackers are also deploying deepfake technology and AI-powered voice cloning. One incident involved a deepfake video call that successfully fooled a finance team into transferring $25 million. AI phishing campaigns targeting finance teams escalated in the first half of 2026, with threat actors using executive voice cloning to authorize fraudulent transactions. IBM Security found that AI-generated spear phishing emails have an open rate three times higher than generic phishing campaigns.

Agentic AI is being utilized for near-autonomous cyberattacks. A July 2026 incident against the Taiwanese government, described as "near-autonomous," compromised 85 accounts and exfiltrated 2,564 personnel records in four days, using open-source AI agent projects like Hermes Agent and OpenClaw. Real-world attacks have also been observed targeting Flowise AI agents with credential theft and prompt injection, indicating that prompt injection is moving from theoretical to exploitable. The China-linked group Storm-0940 was tied to the ConnectWise supply-chain breach, where ARTEX AI agents conducted 2,900 sign-in attempts per minute across 2,250 tenants.

The Timeline

In the first half of 2026, AI phishing campaigns targeting finance teams saw a significant escalation. July 2026 saw a near-autonomous attack against the Taiwanese government. By October 2026, security researchers had identified over a thousand public sandbox analyses related to campaigns impersonating AI products, primarily occurring between April and October 2026. The financial impact in the US for 2024, reaching $16.6 billion in social engineering losses, represents a marked increase.

What Changed and for Whom

The integration of AI into cybercriminal tactics has changed the nature of social engineering. Attackers can now create more convincing lures, automate parts of their operations, and scale their efforts more effectively. This directly impacts organizations and individuals, leading to substantial financial losses, as evidenced by the $16.6 billion in US social engineering losses reported to the FBI in 2024. The rise of malicious AI installers and deepfake-integrated lures means users face more sophisticated threats when interacting with seemingly legitimate AI tools or communications.

What We Could Not Confirm

We could not confirm any public statements from the specific cybercriminal groups or individuals responsible for these attacks, such as those behind the $25 million deepfake incident or the Taiwanese government breach. We also could not confirm specific details about the methods used by law enforcement or cybersecurity agencies to counter these AI-powered threats beyond general security advisories.