Suppliers, logins, and AI tools are all becoming attack paths
Cybercriminals and state-backed hacking groups are abusing trusted identities, cloud services, AI tools, and software supply chains to gain access while avoiding detection, according to CrowdStrike’s 2026 Threat Hunting Report.
Intrusion activity increased by about 4% over the past year. Even though the increase was smaller than in the previous reporting period, it shows a growing focus on more targeted campaigns. Attackers are investing more time in exploiting trusted access paths and legitimate infrastructure.
AI speeds up attacks
Threat actors are using LLMs to generate malware, phishing emails, reconnaissance commands, and scripts after compromising systems. AI is helping identify vulnerabilities, generate proof-of-concept (PoC) exploits, and shorten the time between vulnerability disclosure and exploitation.
“AI is changing how attacks are planned, executed, and scaled while expanding the attack surface organizations must defend,” said Adam Meyers, head of counter adversary operations at CrowdStrike. “The organizations that succeed will secure AI as aggressively as they adopt it and use AI to defend at the speed of the adversary.”
Attackers exploited AI server software to steal sensitive configuration data and install cryptocurrency miners, while financially motivated groups abused enterprise AI platforms in attacks known as LLMJacking.
One incident involved attackers gaining administrative access to a cloud account before sending nearly 200,000 requests to LLMs within two minutes, consuming AI resources at the victim’s expense.
Adversaries are exploiting newly disclosed vulnerabilities more quickly. Between January and June 2026, 88% of observed exploitation involving vulnerabilities with publicly available PoC code occurred within 48 hours of its release. China-linked groups launched attacks within 24 hours of the disclosure of a critical web application vulnerability.
Developer ecosystems become prime targets
Attackers hid malware in software packages uploaded to public repositories used by developers. Once installed, the packages could distribute malicious code to thousands of downstream users.
The npm package registry accounted for 87% of malicious software packages identified during the reporting period.
Adversaries are compromising package registries, CI/CD pipelines, container registries, and IDE extensions because they provide access to production systems, cloud environments, and customer networks.
The North Korea-linked STARDUST CHOLLIMA group and the financially motivated ALTERED SPIDER were identified as the most active software supply chain attackers. One ALTERED SPIDER campaign allegedly compromised more than 300 software dependencies in a single day, allowing the group to steal credentials and access cloud environments.
Vishing keeps gaining ground
Vishing has become one of the fastest-growing methods of gaining initial access. Attackers impersonate IT support staff over the phone and persuade employees to enter credentials into fake login pages or approve remote access using legitimate software such as Microsoft Quick Assist. Because these attacks rely on valid credentials, they often bypass traditional security tools.
CrowdStrike OverWatch-detected intrusions in which vishing was the likely initial access vector per month, January 2024-June 2026 (Source: CrowdStrike)
Vishing-related intrusions increased 134% between 2024 and 2025. Activity accelerated further during the first half of 2026, when twice as many incidents were observed as during the previous six months.
The groups CORDIAL SPIDER and SNARKY SPIDER used the technique to compromise single sign-on accounts before accessing Microsoft 365 and Google Workspace environments. In one SNARKY SPIDER intrusion, attackers progressed from account takeover to data theft in less than five minutes.
Cloud credentials under attack
Cloud-focused cybercrime activity increased 171% over the past year, driven by credential theft, cryptocurrency mining, AI service abuse, and attempts to steal digital assets.
One of the fastest-growing techniques is device code phishing, which abuses Microsoft’s legitimate authentication process. Attackers trick users into authorizing malicious logins through trusted authentication workflows. Device code phishing attempts increased 15-fold during the past six months.
Attackers are targeting cloud credentials, API keys, and secrets stored in cloud services to gain access to cryptocurrency wallets and other valuable assets. Detecting these intrusions often depends on identifying unusual cloud activity because attackers frequently rely on legitimate accounts and authentication tokens.
Technology, finance, and education remain key targets
Technology remained the most targeted industry for the ninth consecutive year because organizations in the sector hold valuable intellectual property and serve as gateways to software supply chain compromises.
Financial services recorded an 11% increase in intrusion activity during the reporting period, while attacks targeting universities and research institutions rose 17%, the largest increase among all sectors. Financial institutions continue to attract attackers seeking financial assets and customer data, while academic organizations are increasingly targeted for research and intellectual property.
Download: The high-performance team playbook