Ransomware crews are increasingly turning to generative AI not to invent new tricks, but to execute old ones faster and with far less effort, according to new research from Zscaler. The analysis, published October 16 by principal security researcher Phil Hagen, describes how attackers are using large language models across nearly every stage of an intrusion, from writing convincing phishing lures to building one-off malicious scripts that slip past signature-based defenses.

The report does not point to a single new malware family or a confirmed campaign tied to one group. Instead, it documents a broader shift in tradecraft that is already reshaping how quickly attackers can move from initial access to data theft and encryption, and why the security tools built to catch yesterday’s threats are struggling to keep pace.

Custom Code Without the Custom Development Team

Traditional malware detection leans heavily on recognizing known file signatures and behavioral patterns collected from past samples. That approach works reasonably well against reused tools, but it falls apart against code that changes every time it’s deployed. Zscaler says generative AI has made that kind of rapid variation trivial to produce: attackers no longer need to rely on widely circulated, well-tracked malware families when they can prompt a model to generate a fresh variant in minutes.

That shift also undermines a long-standing forensic shortcut. Analysts have historically treated custom, one-off malware as a signal that a well-resourced or highly skilled group was behind an attack. Zscaler warns that assumption no longer holds, since freely available AI models now let smaller, less sophisticated ransomware crews produce bespoke tooling that looks just as unfamiliar to defenders as code from a top-tier threat actor.

• AI-generated phishing emails and fake websites increasingly avoid the spelling and grammar mistakes employees are trained to spot, in any target language.
• Some campaigns use AI-polished lures to convince victims to install legitimate remote monitoring and management software, which attackers then abuse for hands-on-keyboard access.
• Once inside a network, AI tools help attackers sort through large volumes of accessible files far faster than manual review or scripted search, speeding up the hunt for valuable data to steal or encrypt.

A Shrinking Window for Defenders

Zscaler frames the core problem as a compressed timeline. Faster lure creation, faster malware iteration, and faster data discovery combine to leave security teams with noticeably less time to notice and respond to an intrusion before damage is done. A ransomware operator that once needed days to manually sift through a compromised file server can now lean on AI-assisted classification to find sensitive material in a fraction of that time, increasing pressure on victims before a response team even finishes its initial triage.

It’s worth drawing a distinction the report is careful to make: this is evidence of AI-assisted development, not proof that malware payloads are rewriting themselves autonomously while running on a victim’s machine. Separate research has explored that more advanced, self-modifying concept, but Zscaler’s findings describe attackers using AI tools during the planning and build phase of an operation rather than malware with independent code-generation abilities baked in at runtime.

Rethinking Detection Around Behavior, Not Signatures

The practical implication is that detection strategies anchored purely on matching known malicious files are losing relevance. Zscaler argues that defenders need to shift toward evaluating what a program actually does on a system, rather than whether its file hash or structure resembles something previously catalogued. That means greater reliance on behavioral analytics, combining signals across endpoint, network, and cloud telemetry, and shortening the time between an alert firing and an analyst investigating it.

The report also points to the browser as an emerging blind spot. Related research has shown that AI-generated code injected into a web page after it loads can alter what a user sees in real time, meaning a page that looks clean on initial inspection can still deliver malicious content moments later. That technique sits outside Zscaler’s ransomware-focused analysis, but it reinforces the same underlying message: static, one-time checks are increasingly inadequate against threats that are dynamically generated or modified.

What Security Teams Should Do Now

Organizations don’t need to treat every AI-themed headline as an immediate five-alarm fire, but Zscaler’s findings are a useful prompt to stress-test assumptions. Security teams should evaluate how much of their detection stack still depends on static signatures versus behavioral and contextual analysis, and should treat “this looks professionally written” as a weaker signal of legitimacy than it used to be, both in phishing training and in automated filtering. Faster attacker tooling ultimately demands faster, more automated defensive response, since the manual review cycles that once kept pace with slower-moving ransomware crews are quickly becoming a liability.