Threat Actor Uses AI to Build EDR Evasion Tools - Infosecurity Magazine

Sophos X-Ops uncovered a threat actor using AI coding tools to develop and refine malware designed to evade endpoint detection and response (EDR) software. The activity was detailed by Infosecurity Magazine on June 1, 2026. The threat actor operated a lab that used a Python tool to wrap payloads in encryption and evasion techniques, according to the Sophos report.

The Python tool was specifically constructed to assist in evading EDR systems, which are commonly deployed to detect and block malicious software. Sophos did not name the threat actor group but indicated that the lab was actively developing custom evasion code. The article notes that the AI tools used were general-purpose coding assistants, not specialised malware generators.

The incident highlights the dual-use nature of AI coding tools, which can be leveraged by both legitimate developers and malicious actors. The case underscores ongoing challenges in the cybersecurity industry as AI capabilities continue to evolve.