Microsoft discovers AI-generated code used to obfuscate malware in phishing campaign
Microsoft researchers discovered a phishing campaign using AI-generated code to obfuscate malware hidden in SVG files disguised as PDF documents. The attackers used complex, verbose code and invisible dashboard elements to evade traditional security defenses before attempting credential theft.
What happened
Hackers used artificial intelligence-generated code to obfuscate malware in a phishing campaign, according to Microsoft research released on September 24, 2025. The phishing emails employed self-addressing tactics to hide actual targets in the BCC field and contained SVG file attachments disguised as PDF documents to bypass detection systems.
The malicious SVG files contained invisible elements designed to resemble legitimate business analytics dashboards, with chart bars and month labels rendered invisible through zero opacity settings. When targets opened the SVG file, they were redirected to a webpage prompting CAPTCHA completion, a social engineering tactic intended to build trust before presenting fake sign-in pages.
Reported impact
Microsoft Security Copilot analysis determined the code was "not something a human would typically write from scratch due to its complexity, verbosity and lack of practical utility," indicating AI-generated obfuscation designed to evade traditional security analysis.
Index analysis
The attackers used business-related language and dummy dashboard elements rather than cryptographic obfuscation to disguise malicious activity, leveraging SVG format features including invisible elements, encoded attributes and delayed script execution to evade static analysis and sandboxing.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.