AI-Accelerated Intrusions and Malware Campaigns Reduce Time to Domain Compromise

Threat actors increasingly abused legitimate AI tools and automation to accelerate intrusions, with CrowdStrike reporting an 89% YoY increase in AI-enabled adversary activity and an average eCrime breakout time dropping to 29 minutes (fastest observed 27 seconds). CrowdStrike also described attackers poisoning or hijacking local AI tooling via malicious JavaScript embedded in npm packages targeting tools such as Claude and Gemini to steal credentials and crypto assets, and highlighted a CHATTY SPIDER intrusion that began with voice phishing and remote access via Microsoft Quick Assist, followed by attempted exfiltration using WinSCP and a fallback to Google Drive when blocked.

Separate reporting detailed additional active campaigns and exploitation trends consistent with faster initial access and persistence: UAC-0050 (DaVinci Group / “Mercenary Akula”) used spear-phishing with spoofed Ukrainian judicial themes and multi-layer archives (ZIP→RAR→passworded 7z) to deliver an *.pdf.exe dropper that installed Remote Manipulator System (RMS) for remote control and file transfer against a European financial institution. UnsolicitedBooker shifted targeting to telecoms in Kyrgyzstan and Tajikistan, using phishing documents that prompt “Enable Content” to run macros that drop loaders (e.g., LuciLoad, MarsSnakeLoader) and deploy LuciDoor and MarsSnake backdoors. Vulnerability intelligence for January 2026 also warned of active exploitation including APT28 use of a Microsoft Office zero-day (CVE-2026-21509) via weaponized RTFs to deliver implants (e.g., Covenant), alongside multiple critical authentication-bypass and RCE issues affecting enterprise platforms—reinforcing that adversaries are combining rapid social engineering, supply-chain style delivery, and exploited vulnerabilities to compress dwell time and speed lateral movement.