CrowdStrike has released its 2026 Threat Hunting Report, revealing that AI is now embedded across modern adversary operations. Threat actors are operationalizing AI to exploit vulnerabilities within hours, target enterprise AI, and scale attacks across software supply chains.
China-nexus adversaries exploited critical vulnerabilities within 24 hours of public proof-of-concept (PoC) release.
DPRK-nexus STARDUST CHOLLIMA injected a malicious npm package into 131 trusted Mastra AI frameworks.
In 1H 2026, 88% of observed exploitation of vulnerabilities with a PoC occurred within 48 hours of release.
Cloud-conscious eCrime activity surged 171% as adversaries executed credential theft, cryptomining, and LLM abuse.
AI agent-triggered detection leads grew at 2.5x the rate of human-triggered leads.
Vishing intrusions increased 2x in 1H 2026, with monthly device code phishing attempts jumping 15x.
CrowdStrike today released the 2026 Threat Hunting Report, revealing that AI is now embedded across modern adversary operations. China-nexus adversaries exploited critical vulnerabilities within 24 hours of public proof-of-concept (PoC) release, while DPRK-nexus adversaries poisoned 131 trusted AI framework packages, demonstrating how AI has become both an operational capability and a high-value target.
AI is now a tool, target, and force multiplier for adversaries. As enterprises embed AI across their business, adversaries are exploiting AI infrastructure, compromising software supply chains, abusing enterprise LLMs, and following AI workloads into the cloud. The result is a new operational reality: attacks move faster, scale more efficiently, and increasingly target the AI systems enterprises depend on.
Based on frontline intelligence from CrowdStrike's elite threat hunters and intelligence analysts tracking more than 290 named adversaries, the report reveals:
AI Is a Tool, Target, and Force Multiplier for Adversaries: Threat actors used AI to generate payloads and shell commands, exploit AI infrastructure, and abuse enterprise LLMs – including one campaign that sent nearly 200,000 AI model requests in two minutes. CrowdStrike OverWatch also observed AI agent-triggered detection leads grew at 2.5x the rate of human-triggered leads, showing how AI is accelerating the volume and velocity of activity security teams must investigate.
The AI Ecosystem Is the Next Supply Chain Battleground: DPRK-nexus STARDUST CHOLLIMA injected a malicious npm package into 131 trusted Mastra AI frameworks. During 1H 2026, 87% of identified software registry threats involved malicious npm packages. eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments.
Exploitation Windows Collapse to Hours: In 1H 2026, 88% of CrowdStrike-observed exploitation of vulnerabilities with a PoC occurred within 48 hours of release. China-nexus actors VAULT PANDA and GENESIS PANDA moved even faster, launching deliberate attacks within 24 hours of disclosure. After the React2Shell vulnerability disclosure, CrowdStrike OverWatch responded to 800+ hunting leads across more than 80 victims in just four days.
Adversaries Follow AI into the Cloud: Cloud-conscious eCrime activity surged 171% as adversaries executed credential theft, cryptomining, LLM abuse, and digital financial asset theft. In one case, a threat actor hijacked cloud resources across three parallel attack vectors, mining about $41,000 worth of Monero while altering instance settings to stop the victim reclaiming the compute.
Trusted Authentication Becomes an Attack Path: Vishing intrusions increased by 2x in 1H 2026. eCrime groups CORDIAL SPIDER and SNARKY SPIDER compromised single sign-on (SSO) integrated SaaS applications for data exfiltration. In one incident, SNARKY SPIDER moved from account takeover to data theft in under five minutes. Monthly device code phishing attempts increased 15x in 1H 2026, reflecting growing abuse of trusted authentication workflows.
Between March and May, OverWatch disrupted close access operations in which China-nexus adversary Overcast Panda installed its FlowCloud backdoor on unattended laptops belonging to travelers inside China. Technology was the most targeted sector for the ninth consecutive year, while financial services recorded an 11% increase and academic institutions saw a 17% rise in attacks.
"AI is now embedded in modern adversary operations. It is changing how attacks are planned, executed, and scaled while expanding the attack surface organizations must defend," said Adam Meyers, head of counter adversary operations at CrowdStrike. "The organizations that succeed will secure AI as aggressively as they adopt it and use AI to defend at the speed of the adversary".
About CrowdStrike
CrowdStrike, a global cybersecurity leader, has redefined modern security with the world's most advanced cloud-native platform for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data. Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft, and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting, and prioritized observability of vulnerabilities.
TechIntelPro empowers B2B technology decision-makers with the latest industry trends, deep insights, leadership perspectives and actionable intelligence to drive both organizational and professional milestones, and thrive on the tech pulse.
