Ledger / 18 Aug 2025
Credential phishing campaign with LLM-obfuscated SVG payload
Strong
Microsoft's analysis (using Security Copilot) judged the obfuscation likely AI-generated; inference from code artifacts.
Phishing emails carried an SVG disguised as a PDF whose JavaScript was obfuscated with business-vocabulary attributes. Microsoft assessed the code was unlikely to be hand-written.
“not something a human would typically write from scratch due to its complexity, verbosity, and lack of practical utility.”Microsoft Security Blog
Sources
- AI vs. AI: Detecting an AI-obfuscated phishing campaignMicrosoft Security Blog · 24 Sep 2025 · primary source
- Date
- 18 Aug 2025
- Disclosed
- 24 Sep 2025
- Actor
- Unnamed (criminal), as attributed by Microsoft Security Blog
- Targets
- Mostly US organizations, via compromised small-business email account
- What the AI did
- Phishing content, Evasion, Malware dev
- Model
- unspecified LLM
- Model family
- Unspecified
- Model basis
- inferred
- Autonomy
- assist
- Outcome
- Blocked by Microsoft Defender for Office 365.