Check Point Research flags rise of deepfake social engineering, LLM poisoning, and dark AI models as top threats in the AI era
AI has officially entered the cyber arms race. Check Point Software Technologies has released its first AI Security Report 2025, highlighting five major categories of AI-driven threats that are transforming the cyber threat landscape faster than traditional defenses can adapt.
Top among them is the exploitation of GenAI platforms, where 1 in 80 prompts posed a high risk of sensitive data leakage. AI is also turbocharging social engineering tactics with real-time deepfakes and synthetic voice, undermining traditional identity verification. A stark example includes the impersonation of Italy’s defense minister using AI-generated audio to cause financial damage.
“Cybercriminals are no longer just using AI — they are building it. Defenders must evolve just as fast.”
— Vasily Dyagilev, Regional Director, Middle East, RCIS, Check Point Software Technologies
The report details how LLM data poisoning is enabling threat actors to manipulate AI responses—sometimes via large-scale disinformation networks like Pravda. Meanwhile, AI-generated malware and tools like FunkSec’s DDoS modules are streamlining the full attack lifecycle, from creation to campaign execution.
Most alarming is the rise of Dark LLMs such as WormGPT and FraudGPT—malicious AI models built by jailbreaking ethical systems or modifying open-source code. These are now sold on the dark web with user support and subscriptions.
“AI is no longer a tool — it’s a threat vector,” said Vasily Dyagilev of Check Point. “Security teams must now defend against an intelligent, adaptive enemy powered by the very technology they deploy.”
Check Point urges CIOs to integrate AI-aware security controls, including deception-resistant identity systems and AI-detection capabilities.
