How AI Democratised Cybercrime: North Korean Hackers Use Tools to Scale Heists

The use of AI by financially motivated state actors and criminal groups represents a watershed: capabilities that once required specialist teams-spearphishing copywriting, malware obfuscation, social engineering scripts, convincing front-end web interfaces-can now be partially automated. That reduces time-to-attack, increases iteration speed, and enables operations to scale economically. The result is more frequent, more credible campaigns with higher expected value per attack.

For organizations, the immediate implications include elevated risk in supply chains, fintech rails, and crypto custody operations. Tactics like 'vibe coding'-using AI to generate plausible but unique malicious code-and AI-crafted fake websites make detection harder for both technical controls and human reviewers. Small teams or inexperienced actors can emulate the playbooks of sophisticated groups, meaning defenders face a growing volume of novel threats that look legitimate.

Business leaders should respond with layered defenses: strengthen identity and payment controls, enforce strict change management for critical systems, and monitor for unusual registration or provisioning behaviors that signal fake services. Operationally, accelerate detection capabilities that focus on behavior and intent rather than static indicators-transaction anomaly detection, device fingerprints, and real-time attestation. Invest in threat intelligence partnerships and share indicators with peers and government agencies to improve collective detection.

Strategically, budget for more frequent red teaming and adopt 'assume breach' postures. Cyber insurance and legal frameworks need updating to account for AI-assisted fraud. Finally, develop executive-level playbooks for public attribution and response; when threat actors are state-linked, business responses intersect with geopolitical and regulatory channels and require coordination beyond IT alone.