HP Research: From Vibe Hacking to Flat-Pack Malware, Low-Effort AI-Built Attacks Are Beating Current Defenses

News Highlights from HP's latest Threat Insights Report:

• Attackers are assembling campaigns using modular malware components, allowing for rapidly built, adapted, and customized attacks.
• AI 'vibe-hacking' techniques are being used in infection scripts, including a campaign abusing a redirect to Booking.com to trick targets into executing malware.
• Oyster loader malware found 'piggybacking' fake Microsoft Teams downloads, smuggling malware onto user devices.

PALO ALTO, Calif., 3 March 2026 - HP Inc. (NYSE: HPQ) today issued its latest Threat Insights Report, with strong indications that attackers are using AI to scale and accelerate campaigns - with many prioritizing cost, effort and efficiency over quality. Despite being formulaic and low-effort, these AI-assisted attacks are slipping past enterprise defenses.

The report provides an analysis of real-world cyberattacks, helping organizations keep up with the latest techniques cybercriminals are using to evade detection and breach PCs in the fast-changing cybercrime landscape. Based on the millions of endpoints running HP Wolf Security*, notable campaigns identified by HP Threat Researchers include:

• Vibe-Hacking Scripts Using Booking.com Redirects: Attackers are using AI to generate ready-made infection scripts - known as vibe-hacking - to automate malware delivery. In one campaign, a link within a fake invoice PDF triggers a silent download from a compromised site before redirecting victims to trusted platforms, like Booking.com.
• Flat-Pack Malware Speeds Up Campaign Building: Threat actors are assembling attacks using inexpensive, off-the-shelf malware components, likely purchased from hacker forums. While lures and final payloads change, attackers are reusing the same intermediate scripts and installers - allowing them to quickly build, customize, and scale campaigns with minimal effort. Notably, this isn't the work of a single threat group; multiple, unrelated actors are using the same building blocks.
• Malware Hidden in Fake Teams Installer 'Piggyback' Attack: Campaigns distributed malware using search engine poisoning and malicious adverts that promote fake Microsoft Teams websites. Victims download a malicious installer bundle in which hidden Oyster Loader malware piggybacks on the Teams installation process, allowing the real app to install while the infection runs unnoticed - giving the attacker backdoor control of the user's device.

Alex Holland, Principal Threat Research, HP Security Lab, comments: "It's the classic project management triangle - speed, quality and cost. You often sacrifice one of them. What we're seeing is many attackers are optimizing for speed and cost, not quality. They are not using AI to raise the bar; they're using it to move faster and reduce effort. The campaigns themselves are basic but the uncomfortable reality is they still work."

By isolating threats that have evaded detection tools on PCs - but still allowing malware to detonate safely inside secure containers - HP Wolf Security has insight into the latest techniques used by cybercriminals. To date, HP Wolf Security customers have clicked on over 60 billion email attachments, web pages, and downloaded files with no reported breaches.

The report, which examines data from October-December 2025, details how cybercriminals continue to diversify attack methods to bypass security tools with no reported breaches.

• At least 14% of email threats identified by HP Sure Click bypassed one or more email gateway scanners.
• Executable files were the most popular delivery type (37%), followed by .zip (11%) and .docx (10%).

Dr. Ian Pratt, Global Head of Security for Personal Systems at HP Inc., comments: "AI-assisted attacks are shining a spotlight on the limitations of detection-led security. When attackers can generate and repackage malware in minutes, detection-based defences can't keep up. Instead of trying to spot every variant, organizations need to reduce exposure. By containing high-risk activities - like opening untrusted attachments or clicking unknown links - within an isolated environment, businesses can stop threats before they cause damage and remove an entire class of risk."

Please visit the Threat Research blog to view the report.

About the Data

This data was gathered from consenting HP Wolf Security customers from October - December 2025 with investigations conducted by the HP Threat Research Team.

About HP Wolf Security*

HP Wolf Security is world class endpoint security. HP's portfolio of hardware-enforced security and endpoint-focused security services are designed to help organizations safeguard PCs, printers, and people from circling cyber predators. HP Wolf Security provides comprehensive endpoint protection and resiliency that starts at the hardware level and extends across software and services. Visit https://hp.com/wolf.