AI's role in cybersecurity

We combat phishing and online fraud

Online fraud has become more sophisticated over the years: modern phishing sites look neat, their text is often error‑free, and the visual elements mimic the interfaces of well‑known services. To combat these threats, we use machine learning and content analysis.

In particular, Kaspersky protects against phishing through:

• optical character recognition (OCR) to identify malicious text hidden within images
• proprietary ML models that identify the telltale signs of fraud, having been trained on datasets of legitimate and counterfeit websites.

This is especially important as scammers increasingly use images and visual bait to try to bypass simple filters.

We help SOC specialists be more effective

In corporate environments, security professionals often encounter excessive "noise," i.e. a large number of alerts that do not represent real incidents. This wastes a lot of time.

Our Managed Detection and Response (MDR) services use AI algorithms to automatically analyze event streams and filter out false positives, allowing tens and hundreds of thousands of benign incidents to be resolved each year without human intervention. As a result, security operations center (SOC) specialists can focus on truly important attacks and respond more quickly to real threats.

Our enterprise monitoring and response solutions (Kaspersky SIEM and Kaspersky XDR) use machine learning for risk scoring when evaluating the behavior of devices and servers within the infrastructure. This helps identify hidden attacks and anomalies without sharing data outside the company, which is especially important for organizations with stringent confidentiality requirements.

We research large language models

Generative AI and large language models have already become part of digital reality. We are developing infrastructure for researching and safely using their capabilities and for rapid prototyping. We deploy LLM tools, such as ChatGPT, in this environment, where they are available to employees across all departments for day‑to‑day tasks while also serving as a foundation for developing new solutions.

A key practical scenario is using language models to assist analysts. In particular, the Kaspersky Threat Lookup service (part of the Kaspersky Threat Intelligence Portal) now enables AI-enhanced opensource intelligence search, providing customers with summaries and article abstracts related to analyzed objects in the OSINT (Open-Source Intelligence) Open-Source Intelligence — a branch of intelligence that analyzes information about people or organizations from sources available to the public tab, saving them time when searching for IoCs (Indicators of Compromise) or researching cybersecurity reports.

Examples of detected malware that was created using AI or that has an AI theme

• FunkSec. Our analysis of the ransomware revealed signs of automated code generation. The targets include public sector, IT, financial, and educational organizations in Europe and Asia.
• RevengeHotels. We detected a new wave of attacks on hotels that aims to steal bank card data. Samples created using AI have been identified in the campaign.
• Malware disguised as DeepSeek and Grok. Campaigns with fake pages that distributed a stealer, a malicious PowerShell script A PowerShell script used by attackers to covertly execute commands, download malicious code or control an infected system., and a backdoor. Links to one of the malicious resources were posted online, including on the social network X (formerly Twitter).
• BrowserVenom. A phishing resource imitating the DeepSeek website invited visitors to download a model for Windows, but in reality, it distributed a Trojan that intercepts traffic.
• Jarka. Malicious packages distributed through the Python Package Index (PyPI) repository under the guise of tools for neural network‑based chatbots infected devices with a stealer.
• Gipy. The downloader was distributed under the guise of a neural network‑based voice‑changing app.

How we manage AI safety

We view AI safety as a complex issue that extends far beyond AI technologies themselves. It isn't just about protecting algorithms and models, but also about how AI is used at Kaspersky, what data it processes, what risks it creates, and how these risks are managed.

AI safety is multifaceted. It involves:

• legal and compliance issues—for example, what data is permissible to use and send to cloud‑based AI services
• IT and information security processes, including access management, configuration control, and preventing the use of so‑called "shadow AI," i.e. when employees use external AI tools without approval;
• processes used to develop and train models, where it is important to understand data sources, possible biases, model vulnerabilities, and scenarios where models could be abused.

Effective management of these risks requires specialists from various fields: information security, IT, and legal teams, as well as data science and machine learning experts. Ideally, dedicated AI security specialists would coordinate the work of these teams.

We also recognize AI security is a very rapidly evolving field. New approaches, vulnerabilities, attack methods and security tools are constantly emerging. Therefore, we believe AI risk management is an ongoing process that requires knowledge, practices and training materials to be regularly updated.