Threat Actors Use AI To Bypass Defenses

In 2025, cybersecurity reporting documents a sharp rise in AI-generated phishing, QR-code “quishing,” and large malware campaigns distributing RenEngine, HijackLoader, Lumma, and ACR Stealer. Kaspersky tracked RenEngine activity since March 2025 and reports hundreds of thousands of global infections with thousands of new victims daily. The report warns that generative AI and QR lures evade URL-based defenses, urging combined computer-vision detection, behavior-based endpoint protection, and user training.