AI-generated attacks erase “digital footprint” and complicate attribution

The use of the generative artificial intelligence (AI) on the part of the cybercriminals to create all types of malicious attacks is an increasingly growing reality and, in addition to helping to generate attacks by increasing sophistication, it also protects them by erasing their “digital footprint” and complicating the attribution of attacks.

This has been warned by experts from the Global Research and Analysis Team (GReAT) of the cybersecurity company Kaspersky, within the framework of their report on Future Predictions. Advanced Persistent Threats (APT) by 2026, in which it illustrates how the threat landscape will evolve during this year.

Specifically, experts have detailed that one of the factors that will condition the cybersecurity sector during 2026 is that It will become increasingly difficult for researchers to attribute cyberattacks to a specific malicious actor.

This is because the use of generative AI not only represents a problem at the level of sophistication in operations, but is also motivating a change in the “digital footprint” of attackersas Kaspersky has specified in the report.

When generating a cyber attack, components such as code, phishing content, and comments malicious actors’ internals typically contain Distinctive errors or nuances. For example, specific linguistic features or specific programming patterns.

In this way, the Analysts may rely on issues such as coding style or on speakers’ characteristic errors. natives of certain languages ​​to try to attribute cyberattacks to specific or already known malicious groups or cybercriminals.

However, by introducing technology Generative AI For the production of attacks, AI models are responsible for generating everything from malicious code to ‘phishing’ emails. Therefore, the Results tend to be “neutral and standardized”, completely eliminating errors the tears that could distinguish the malicious actor or group in question.

That is, cyberattack researchers They can no longer look for these types of features to try to figure out where they come from and, the greater the adoption of AI by cybercriminals, “these signals are likely to lose reliability,” as the company has stated.

In this framework, it must be taken into account that, during the first months of 2026it has been increased use of agentic AI to develop malicious tools advanced in a matter of days, instead of the months previously needed, including more technical equipment, as the cybersecurity company Check Point Research has warned.

An example of this change has been carried out by VoidLinka ‘malware’ framework for cloud-native Linux that had a level of sophistication that seemed to have been created over months by a work team, as it integrated more than 30 post-exploitation modules, advanced cloud capabilities and use of rootkits. However, VoidLink was really created by a single developer that relied on agentic AI.

There have also been other examples such as the case of Slopoly, an AI-generated ‘malware’ that has been used in large-scale extortion campaigns to allow cybercriminals to stay on a server for a week.

Sponsored content