Cybersecurity firm Trend Micro has warned that artificial intelligence (AI) is increasingly being used by cybercriminals to accelerate illegal operations, underscoring the growing risks posed by emerging technologies.
At the Decode 2025 conference on Sept. 9, Trend Micro researchers briefed industry stakeholders and government representatives on how malicious actors are exploiting AI to bypass safeguards, create deepfakes, and streamline scams.
While there is no dedicated “criminal large language model,” the company said hackers have found ways to jailbreak mainstream AI systems, repurposing them for malicious activities.
Among the rising threats are AI-generated voice and face clones used in so-called “virtual kidnapping” scams, where criminals fabricate convincing messages and videos to extort families without carrying out an actual abduction.
Researchers also flagged the rise of hacking tools and services available for free online, a shift from the “hacking-as-a-service” schemes discussed in last year’s Decode conference.
With AI’s ability to automate tasks, criminals are more easily bypassing know-your-customer (KYC) checks and gaining access to sensitive systems and data.
Stephen Hilt, Trend Micro senior threat researcher, outlined three key cybercriminal ecosystems:
- Russian-speaking underground groups, known for ransomware and phishing campaigns, operating under strict reputation systems and often avoiding activity within Russia.
- Spanish-speaking groups, active on Telegram and focused on financial fraud, including credential theft and bank identification number (BIN) attacks.
- English-speaking groups, which sell access and phishing kits while quickly exploiting “zero-day” vulnerabilities.
Morton Swimmer, principal threat researcher at Trend Micro, noted that AI has become a double-edged sword — empowering both criminals and cybersecurity defenders.
“As adversaries weaponize AI to scale operations, security researchers are equally turning to AI for detection and response,” he said.
Trend Micro stressed that public awareness and digital resilience remain critical.
“Technology alone cannot stop these threats,” Swimmer added. “Education and prevention are just as important in safeguarding against cyber risks.”
