When Attackers Target the AI Instead of the User
For years, phishing had one goal, which was to get a person to click. That goal is now expanding. Attackers are building malicious documents that are designed to fool not only the user but also the automated security tools that inspect those files. As more companies add generative AI and large language models to their email security, malware analysis, and incident response, attackers have started treating the AI itself as something to bypass, overload, or mislead.
This is a quiet but meaningful change in how attacks are built. Instead of spending all their effort on new malware or fresh exploits, threat actors are studying how AI reads files, then adjusting those files to shape what the AI concludes. Often the harmful part of the file does not change at all. What changes is everything around it. Attackers add content that raises processing costs, fills up the model’s limited working memory, and buries a small piece of malicious code under a mountain of meaningless text, all to lower the odds that an AI inspection engine spots the threat. Unlike older tricks meant to dodge antivirus signatures, these newer methods go after the analysis process itself.
Obfuscation Is Moving Beyond Malware
Hiding code has always been a core attacker technique. Programs have long been packed, encrypted, compressed, or padded with junk data to frustrate analysis and signature detection. The MITRE ATT&CK framework groups many of these methods under T1027, Obfuscated Files or Information, which reflects how common they are across malware families. One documented method under that technique is padding a file to make it larger without changing what it does, purely to slow down or confuse detection tools.
The same idea is now showing up inside everyday documents. HTML attachments, PDFs, Office files, JavaScript, and other common formats can carry large amounts of content that does nothing when a person opens the file, yet makes automated analysis far heavier. Hidden comments, repeated markup, excessive whitespace, deeply nested elements, duplicated text, encoded blocks, and deliberately bloated structures all do one job, which is to force a security engine to chew through far more information than it actually needs to understand the file. To a browser or document viewer, these additions are basically invisible. To an AI model, they become part of the input it has to read, interpret, and rank.
AI Creates a New Attack Surface
Large language models were built to read language, summarize, spot patterns, and support human analysts. Those same strengths make them useful in a modern security operations center, where they help with phishing triage, malware review, alert ranking, and threat hunting. But these models also have built-in limits that attackers can exploit on purpose. Every model has a finite context window, real compute constraints, and a token budget. Very large or deliberately noisy inputs burn through those resources and pull the model’s attention away from the part of the file that actually matters.
OWASP now tracks this class of risk in its 2025 Top 10 for LLM Applications as LLM10, Unbounded Consumption, which was formerly called Model Denial of Service. The idea is that oversized or carefully built inputs are meant to drain compute, inflate cost, or interfere with reliable model behavior rather than exploit a traditional software flaw. Unlike a classic denial-of-service attack that eats network bandwidth or CPU, this one eats reasoning capacity. The result is that an AI engine can spend real effort combing through thousands of lines of filler while the actual credential-stealing script sits in a tiny corner of the file.
Why HTML Is the Ideal Delivery Vehicle
HTML is one of the most flexible formats an attacker can use. Email standards defined in RFC 5321 and RFC 5322 allow HTML documents to travel as ordinary MIME attachments, and enterprise mail systems routinely deliver them untouched. Opened locally, an HTML file can display a convincing login page with forms, JavaScript, images, styling, and remote content that closely mimics a real cloud service.
Unlike an executable, an HTML file usually looks harmless to a user because it reads as a normal web page. Yet it can collect credentials, redirect victims, pull in more content from remote servers, and run substantial code in the browser. As companies get better at blocking macro-enabled Office files and executable attachments, HTML has become a preferred format for credential theft. Adding AI-focused obfuscation on top simply makes these files harder for automated systems to inspect quickly.
The Next Phase Will Reach Beyond HTML
HTML is common today, but there is little reason to think attackers will stop there. The same approach applies to PDFs stuffed with excess metadata, Office files with inflated XML, archives packed with pointless nested objects, image formats carrying oversized embedded data, and scripts padded with thousands of meaningless variables and comments. Generative AI has lowered the effort required to create these evasive structures. Producing thousands of unique lines of harmless-looking filler is now trivial, which lets attackers generate files that all look different while behaving identically. As AI-assisted malware development matures, document padding and this kind of semantic obfuscation are likely to become standard parts of phishing kits rather than niche tricks.
Why Structure Matters More Than Content
This shift points to an important difference between interpreting content and validating structure. Many AI security products try to decide whether a document is malicious by reading its text, scripts, or visuals. That adds useful context, but it also means the security decision depends on successfully processing everything the attacker chose to include, including all the filler.
FileDNA takes a different route. Instead of trying to understand every sentence, comment, or block of irrelevant text, FileDNA starts by validating the file itself. It identifies the true file type regardless of extension, parses the document according to its real format, follows embedded objects through every layer of nesting, locates active content, and determines which parts can actually run code or reach external systems. Large amounts of non-functional content have little effect on this, because the analysis focuses on what the document can do, not how much noise surrounds it. Whether an attacker adds ten hidden comments or ten thousand, the file still contains the same scripts, embedded objects, external references, forms, and active components, and those remain visible to FileDNA because they are judged by the document’s architecture rather than its story.
CADR Neutralizes the File Before AI Ever Sees It
FileDNA’s Content Analysis, Disarm, and Reconstruction technology, or CADR, takes this a step further than detection. Rather than asking whether a document is probably malicious, CADR rebuilds the file into a trusted version by removing active content that falls outside security policy. Embedded scripts, unnecessary executable elements, suspicious objects, malformed structures, hidden active components, and other dangerous embedded content can be stripped during reconstruction while the legitimate business information users need is preserved.
That changes the defensive model. Instead of leaning only on more and more complex AI analysis to judge an attachment, organizations can neutralize dangerous content before the file ever reaches users, browsers, endpoints, or downstream AI systems. In effect, CADR shrinks the attack surface available to both traditional malware and these emerging AI-focused evasion techniques.
Looking Ahead
The industry has spent decades building better detection engines. The next stage of the arms race is likely to focus less on hiding malware and more on manipulating the systems that interpret it. As generative AI becomes embedded throughout enterprise security products, attackers will increasingly tune their files for AI consumption rather than human inspection. That reinforces a principle that has held steady through every change in attack technique, which is that trust should come from deterministic validation of file structure, not from interpretation of file content alone.
AI will remain an invaluable tool for analysts, threat hunters, and responders. But it works best on files that have already been structurally validated and cleaned. By combining deterministic file analysis with Content Analysis, Disarm, and Reconstruction, technologies such as FileDNA provide a resilient foundation that stays effective whether attackers are trying to evade signatures, heuristics, or the next generation of AI-powered security platforms.
References
- MITRE ATT&CK. Obfuscated Files or Information, Technique T1027, Enterprise.
- OWASP GenAI Security Project. LLM10:2025 Unbounded Consumption (formerly Model Denial of Service), OWASP Top 10 for LLM Applications.
- Internet Engineering Task Force. RFC 5321, Simple Mail Transfer Protocol.
- Internet Engineering Task Force. RFC 5322, Internet Message Format.