Request ConsultationAI is helping cybercriminals automate attacks, create convincing phishing messages, and identify security weaknesses in banks and critical infrastructure. Organizations are strengthening cybersecurity, monitoring systems, and access controls to protect sensitive data and essential services.
Artificial intelligence is changing the cybersecurity landscape by giving organizations new ways to identify threats, monitor networks, and protect sensitive information. However, the same technology is also creating opportunities for cybercriminals to improve their operations. Tasks that once required considerable technical knowledge, time, and resources can increasingly be supported by AI tools, making cybersecurity more accessible to individuals with limited hacking experience.
Recent incidents in South Korea and Japan have highlighted these growing concerns. On October 9, 2026, Reuters reported that companies and financial institutions across both countries were strengthening their cybersecurity measures following a series of attacks that experts said could reflect the growing use of artificial intelligence. Nine South Korean banks were investigating cyberattacks that may have involved AI tools, while Japanese companies, including Daiwa Securities, SoftBank, and Lawson, were also dealing with a rise in cyber incidents. Authorities were still investigating to determine the extent of AI’s involvement in the reported breaches.
The concern extends beyond financial institutions. Banks, electricity networks, hospitals, telecommunications providers, transport systems, and other essential services depend on interconnected digital infrastructure. A successful cyberattack against these systems can disrupt operations, expose confidential information, create financial losses, and affect public safety.
AI does not independently explain every cyberattack, and not every breach involves advanced technology. However, it can help attackers automate part of the process, communicate more convincingly with victims, and examine potential weaknesses more efficiently.
For businesses and governments, the challenge is becoming increasingly clear. Cybersecurity strategies must evolve as artificial intelligence changes both the scale and the nature of digital threats.
Why is Driving the Rise of AI-Assisted Cyberattacks?
Traditional cyberattacks often required specialized knowledge of computer networks, software vulnerabilities, and security controls. Attackers needed to identify targets, gather information, prepare malicious communications, and determine how to exploit weaknesses.
AI can reduce the efforts involved in several of these activities. General-purpose models and specialized AI agents can assist with research, code analysis, text generation, and repetitive technical tasks. This support can make an attack more efficient without necessarily making the attacker highly skilled.
According to Reuters, cybersecurity specialists believe AI is helping criminals automate activities ranging from vulnerability scanning to the preparation of phishing campaigns. Experts have also warned that language and technical barriers that once limited some attackers are becoming less significant.
This development creates three important challenges for organizations.
First, attackers can potentially pursue more targets with the same resources. Second, AI-generated messages can be adapted to different languages, industries, and individual recipients. Third, automated assistance can help less experienced criminals perform tasks that previously required more technical expertise.
The result is a changing threat environment in which organizations may face a larger number of attempts, more convincing deception, and less time to identify suspicious activity.However, AI is an enabling technology rather than a guarantee of success. Attackers still depend on weaknesses in systems, exposed credentials, vulnerable software, or human error. Effective security controls can prevent many AI-assisted attacks from succeeding.
How Hackers are Using AI to Target Banks
Financial institutions are attractive targets because they manage customer identities, payment systems, account information, and large volumes of confidential financial data. Even when attackers cannot directly access core banking systems, weaknesses in connected services and third-party platforms can create opportunities for data theft or disruption.
AI-Assisted Vulnerability Identification
Cybercriminals can use AI-assisted tools to examine publicly available information, analyze software configuration, and identify potential security weaknesses. Specialized agents may help organize technical findings and prioritize systems that appear vulnerable.
In October 2026, South Korean bank incidents brought attention to the possibility that AI agents could help attackers with relatively limited technical capabilities identify and exploit weaknesses. Reuters reported that CrowdStrike linked a suspected China-based attacker to the incidents and said the campaign likely benefited from AI assistance.
This does not mean that AI can automatically break into every protected banking network. Its effectiveness depends on the information available, the system being targets, and the security measures in place. Nevertheless, automated assistance can increase the number of potential weaknesses an attacker examines.
More Convincing Phishing and Smishing Campaigns
Phishing involves deceptive emails or messages designed to persuade recipients to disclose information, open malicious attachments, or visit fraudulent websites. Smishing uses similar techniques through text messages.
AI can help criminals create convincing messages with fewer grammatical errors, translate them into local languages, and adapt their wording to particular organizations or individuals. Attackers may also use publicly available information to make fraudulent communications appear relevant to a victim’s work or financial activities.
For banks, these attacks can expose login credentials, personal information, or authentication codes. Stolen information may then be used in account takeover attempts or further fraudulent communications.
Reuters reported that a security analyst warned that stolen information from the South Korean incidents could create additional risks if used in phishing or smishing campaigns. This illustrates how a data breach can become the starting point for subsequent attacks rather than an isolated security incident.
Automated Reconnaissance and Repeated Attacks
Reconnaissance involves gathering information about a potential target attempting an intrusion. AI can support the analysis of public records, technology information, and other available materials to help attackers understand an organization’s digital environment.
Automation also allows criminals to repeat certain activities across multiple targets. Instead of manually preparing every attempt, they may use software to organize information and assist with repetitive tasks.
This creates a challenge for financial institutions that operate numerous digital services, mobile applications, customer portals, and external technology connections. A weakness in one part of the environment may create risks elsewhere if access controls and network segmentation are inadequate.
Banks therefore need continuous vulnerability management, secure software development practices, and monitoring that can identify unusual behavior before it develops into larger incidents.
Why Critical Infrastructure Faces Growing Cybersecurity Risks
Critical infrastructure includes the systems and services that support everyday life and economic activity. Electricity generation and distribution, water treatment, healthcare, telecommunications, transportation, and financial services all depend on reliable technology.
Unlike conventional business applications, disruption to critical infrastructure can have consequences beyond financial losses. A prolonged outage may affect emergency services, industrial production, public transportation, or access to essential suppliers.
Energy and Electricity Networks
Modern energy systems increasingly rely on connected monitoring equipment, digital control platforms, and remote operational technologies. These systems help operations manage electricity generation, distribution, and maintenance.
However, connectivity can also increase the potential attack surface. If attackers compromise an exposed account, an inadequately secured remote connection, or a vulnerable supplier, they may attempt to disrupt operations or interfere with access to important systems.
AI could help criminals examine technical information, automate reconnaissance, or prepare deceptive communications targeting employees and contractors. These capabilities could make the preparation of attacks more efficient, although a successful insertion into operational technology still depends on specific system weaknesses and security conditions.
Energy operators need to separate business networks from critical operational systems wherever appropriate, restrict remote access, maintain tested backups, develops procedures for responding to disruption.
Healthcare and Hospitals Systems
Hospitals rely on digital platforms for patient records, diagnostic equipment, appointment scheduling, laboratory services, and communication between healthcare professionals. Cyberattacks can interrupt these functions create additional pressure on clinical teams.
AI-assisted phishing may target hospital employees, while automated tools may help attackers identify exposed systems or poorly protected accounts. Ransomware can these prevent access to important information or disrupt administrative operations.
The consequences can extend beyond the direct cost of recovery. Healthcare organizations must protect patient confidentiality while maintaining essential services during an incident.
Regular security assessments, staff training, access restrictions, and tested recovery plans are therefore important. Hospitals also need procedures for maintaining critical cinical operations if digital systems become unavailable.
Telecommunications and Transportation
Telecommunications providers connect individuals, businesses, financial institutions, and government agencies. Transportation systems depend on digital platforms for scheduling logistics, ticketing, fleet management, and operational coordination.
A breach affecting these services can create wider disruption because other organizations depend on their availability. Attackers may target customer information, attempt ransomware stacks, or exploit weaknesses in connected suppliers.
Japan’s recent incidents have increased attention on this broader problem. Reuters reported a surge in incidents affecting Japanese companies including businesses in financial services, telecommunications, and retail.
Although the involvement of AI has not been confirmed in every reported incident, the wider trend demonstrates why essential service providers must prepare for attacks that can spread across interconnected systems.
What Recent Cyberattacks in South Korea and Japan Reveal
The developments in South Korea and Japan provide a useful example of how cybersecurity risks are evolving.
Reuters reported that South Korea recorded 1,236 cyber incidents during the first half of 2026, a 20% increase from the same period a year earlier. Government data also showed an increase in distributed denial-of-service attacks and ransomware reports.
A distributed denial-of-service, or DDoS, attack attempts to overwhelm online services with excessive traffic, making it difficult for legitimate users to access it Ransomware attacks typically involve malicious software that encrypts or otherwise restricts access to data, often accompanied by demands for payments.
Japan also experienced a significant rise in reported cybersecurity incidents. According to figures from TrendAI cited by Reuters, the country recorded 86 incidents in September 2026, approximately 18% more than August and 37% more than in July. Incidents during the first nine months of the year had already exceeded the total recorded through the previous year.
These figures do not establish that AI caused every incident. Instead, they show the scale of the broader cybersecurity challenge and the need to investigate how emerging technologies may contribute to it.
South Korea’s Financial Services Commission directed financial industry associations, regulators, and affected executives to complete a 12-point cybersecurity self-assessment. Japanese authorities also convened government agencies and planned additional warnings for businesses.
The response highlights an important principle: cybersecurity requires coordinated action across companies, regulators, technology providers, and government institutions.
How AI is Changing Cybersecurity Defense
As AI increases the efficiency of some attacks, organizations are also using artificial intelligence to strengthen their defenses. Security platforms can analyze large volumes of network activity, identify unusual patterns, and help analysts prioritize alerts.
However, AI-based defense should complement established security practices rather than replace them.
Real-Time Threat Detection
Security teams can use behavioral analytics to identify unusual login patterns, unexpected access requests, and suspicious activity across connected systems. Automated analysis may help reduce the time needed to investigate potential incidents.
For example, a login from an unfamiliar location combined with unusual data access could trigger additional verification or an alert for investigation.
These systems must be carefully configured to reduce false positives and avoid overlooking threats that resemble normal activity.
Stronger Identity and Access Management
Stolen credentials remain a major risk because attackers may use legitimate login details to evade basic security checks.
Organizations should implement multifactor authentication, restrict administrative privilege, and apply the principle of least privilege. This means users and applications receive only the access necessary to perform their assigned tasks.
Privileged accounts should receive additional monitoring, and suspicious authentication attempts should trigger appropriate safeguards
Continuous Testing and Vulnerability Management
Organizations need regular assessments of internet-facing systems, software dependencies, cloud environments, and third-party connections. Security teams should prioritize weaknesses according to their severity, exposure, and potential impact.
AI can support parts of this process, but findings must be verified by qualified professionals. Automated systems may produce incorrect results or overlook weaknesses that require deeper investigation.
Incident Response and Recovery
Prevention alone cannot eliminate cyber risk. Organizations need documented incident response plans that define how teams identify, contain, investigate, and recover from attacks.Backups should be protected against unauthorized modification, and recovery procedures should be tested under realistic conditions. Critical infrastructure operators also need plans for maintaining essential services during extended outages.
The objective is not simply to stop every attack. It is to reduce the likelihood of successful compromises and limit the consequences when security controls fail.
Implications for the Banking and Cybersecurity Industries.
The growing use of AI in cybersecurity has several implications for financial institutions, infrastructure operators, and technology providers.
- Higher cybersecurity investment: Organizations may need to spend more on monitoring, security testing, and identity protection. and incident response as attackers automate more activities.
- Greater regulatory scrutiny: Financial regulators and other authorities may require stronger risk assessment, improved reporting, and clearer evidence that organizations can manage emerging threats.
- Third-party risk management: Companies must evaluate the security of technology vendors and connected service providers, since vulnerabilities outside their own networks can still affect their operations.
- Customer trust and data protection: Breaches can expose sensitive information, increase fraud risks, and damage confidence in digital banking and essential services.
- Demand for skilled professionals: Security teams will need expertise in AI-assisted threat detection, incident investigations, cloud security, and the governance of automated systems.
Organizations must also recognize that AI can introduce new risks within their own security operations. Poorly governed AI tools may expose confidential information, generate misleading alerts, or make inappropriate recommendations. Human oversight, access restriction, and real accountability remain essential.
Key Challenge Ahead
Several challenges will shape the next stage of cybersecurity development.
- Attribution and investigation: Establishing who conducted an attack and how AI needs reliable technical evidence rather than assumptions based solely on the apparent sophistication of an incident.
- Speed of attack development: Automated assistance may shorten the time between identifying a weakness and attempting to exploit it, placing pressure on security teams to detect and respond quickly.
- Legacy infrastructure: Some essential systems depend on older technology that cannot easily be replaced or updated without disrupting operations.
- Skills and resource gaps: Smaller institutions and infrastructure operators may lack the personnel and budgets required to implement advanced monitoring and response capabilities.
- International coordination: Cyberattacks can cross borders, involve multiple service providers, and affect organizations operating under different regulatory frameworks. Information sharing and cooperation are therefore important.
Addressing these challenges will require sustained investment, effective governance, and cooperation between the public and private sectors.
What Could Happen Next?
The future of AI-assisted cybercrime will depend partly on how quickly defensive capabilities and security standards improve.
In one scenario, organizations could strengthen their security systems through automated monitoring, better identity control, continuous testing, and coordinated threat intelligence. These measures could make it more difficult for criminals to exploit common weaknesses and could reduce the impact of successful intrusions.
In another scenario, attackers could continue using AI to increase the volume and personalization of their campaigns faster than organizations improve their defenses. This could lead to more frequent investigations, higher recovery costs, and greater regulatory pressure.
A more serious outcome would involve a successful attack that disrupts essential services or spreads across interconnected suppliers and infrastructure operators. Such an event could demonstrate how weakness in one organization can create consequences for many others.
These outcomes are possibilities, not certainties. The extent of AI’s role in future incidents will depend on technological development, attacker behavior, defensive readiness, and the effectiveness of security controls.
Conclusion
The growing use of artificial intelligence in cybercrime is creating new challenges for banks and critical infrastructure operators. By assisting with vulnerability analysis, phishing preparation, reconnaissance, and repetitive technical tasks, AI can lower some of the barriers that previously limited less experienced attackers.
Recent incidents in South Korea and Japan demonstrate the urgency of the issues. Financial institutions and major companies are responding to a rise in cyber incidents, while authorities investigate the role emerging AI tools may have played.
However, AI does not make every cyberattack inevitable, nor does every reported breach prove that artificial intelligence was involved. The real concern is that attackers may use these capabilities to work faster, pursue more targets, and exploit existing weaknesses more efficiently.
For banks, energy providers, hospitals, telecommunications companies, and other essential services operators, the priority is to build resilient security systems. Strong identity controls, continuous monitoring, regular vulnerability assessments, protected backups, and effective incident response plans remain fundamental.
AI can also improve cyber defense when deployed responsibly, but it must operate alongside established security controls and human expertise.
Ultimately, the challenge is not simply to develop better technology. It is to ensure that cybersecurity practices, regulatory oversight, and organizational preparedness keep pace with the changing threat landscape. As AI continues to reshape digital operations, protecting financial systems and critical infrastructure will depend on the ability to anticipate emerging risks, respond quickly, and maintain public trust.
About the Authors
Aditi Shivarkar
Aditi, Vice President at Precedence Research, brings over 15 years of expertise at the intersection of technology, innovation, and strategic market intelligence. A visionary leader, she excels in transforming complex data into actionable insights that empower businesses to thrive in dynamic markets. Her leadership combines analytical precision with forward-thinking strategy, driving measurable growth, competitive advantage, and lasting impact across industries.
Aman Singh
Aman Singh with over 13 years of progressive expertise at the intersection of technology, innovation, and strategic market intelligence, Aman Singh stands as a leading authority in global research and consulting. Renowned for his ability to decode complex technological transformations, he provides forward-looking insights that drive strategic decision-making. At Precedence Research, Aman leads a global team of analysts, fostering a culture of research excellence, analytical precision, and visionary thinking.
Piyush Pawar
Piyush Pawar brings over a decade of experience as Senior Manager, Sales & Business Growth, acting as the essential liaison between clients and our research authors. He translates sophisticated insights into practical strategies, ensuring client objectives are met with precision. Piyush’s expertise in market dynamics, relationship management, and strategic execution enables organizations to leverage intelligence effectively, achieving operational excellence, innovation, and sustained growth.