Loading story…
Cloudflare’s Cloudforce One released its inaugural 2026 Cloudflare Threat Report, warning that attackers are increasingly “industrializing” operations by weaponizing the same cloud and SaaS services organizations rely on. The report highlights how identity- and token-based compromise (e.g., stolen session tokens) can deliver outcomes comparable to complex malware or zero-days, while blending into legitimate cloud traffic and exploiting “seams” between interconnected services. It also forecasts broader normalization of platform abuse, with adversaries using public cloud infrastructure for phishing delivery, infrastructure provisioning, and operational cover.
The report further argues that AI is compressing attacker timelines—speeding target selection, reconnaissance, and execution—by optimizing for attacker “Measure of Effectiveness (MOE),” where low-effort techniques (like token theft) can outperform higher-cost exploit development. It cites trends including more convincing social engineering (e.g., deepfakes), faster exploit iteration, and continued high-scale disruption such as hyper-volumetric DDoS activity, alongside ongoing state-backed intrusions into critical sectors. Separate items in the set—workforce burnout survey results, a detection-engineering newsletter, a vendor “security briefing” covering multiple unrelated February items, and a generic AI security tips article—do not materially add to the specific Cloudflare report story.
Track how attackers are adapting to this technology.
8 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-09, AhnLab ASEC released its Q1 2026 Attack Technique Trends Report, describing AI- and automation-driven threats, identity-centric intrusions, and growing abuse of SaaS, cloud, APIs, and trusted partner relationships. The report also cited specific defense-evasion examples, including Interlock’s use of the Hotta Killer technique with CVE-2025-61155 against FortiEDR and abuse of Carbon Black’s legitimate updater binary to terminate EDR processes.
On March 6, 2026, Cloudflare threat intelligence experts Brian Carter and Chris Pacey discussed the 2026 Threat Report on the 'This Week in NET' podcast. They expanded on AI-driven phishing, botnets, supply-chain risk, token theft, living-off-the-cloud techniques, and state-linked cyber activity.
Alongside the report, Cloudflare recommended moving from judging threats by sophistication to measuring attacker effectiveness and adopting autonomous, real-time defenses. It called for stronger DMARC/DKIM/SPF, tighter SaaS and API controls, and broader Zero Trust protections to counter AI-accelerated attacks.
The report outlined key trends including AI-enabled reconnaissance and exploit development, phishing-as-a-service, session token theft, living off trusted services, email authentication failures, and identity-focused attacks. It also highlighted state-linked activity such as China-linked pre-positioning in North American telecom and government networks and North Korean use of deepfakes and laptop farms.
On March 3, 2026, Cloudflare’s threat intelligence team Cloudforce One released its first annual 2026 Cloudflare Threat Report. The report warned that AI, cloud services, and trusted platforms are enabling faster, more scalable attacker operations.
The threat report said business email compromise attempts surpassed $123 million in 2025, with average targeted amounts around $49,000. The figures were presented as evidence that email-based fraud remained a major threat vector.
Cloudflare reported hyper-volumetric DDoS attacks reaching 31.4 Tbps during 2025, reflecting a major escalation in attack scale. The report also said DDoS volume roughly doubled from 2024 to 2025.
Cloudflare said it disrupted attacker infrastructure by neutralizing more than 400 malicious domains during 2025. The action was cited in later discussion of the company’s threat intelligence and disruption work.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
asec.ahnlab.com
Open sourcesecuritysenses.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public- and private-sector security leaders are increasingly treating **AI adoption as inseparable from cybersecurity**, citing governance, workforce, and operational impacts. U.S. government-focused commentary argues agencies must build “cyber-AI” capability across education pipelines and critical infrastructure, as AI simultaneously improves detection/response and enables faster phishing, malware development, and adaptive attacks. Enterprise security coverage echoes the governance challenge: attempts to **ban AI-enabled browsers** are expected to drive “shadow AI” usage, with concerns including sensitive-data leakage to third parties and **prompt-injection** risks; separate reporting highlights friction between developers and security teams as AI-accelerated delivery increases firewall rule backlogs and delays, pressuring organizations to automate controls without weakening oversight. Threat and risk reporting also points to concrete shifts in attacker tradecraft and defensive tooling. Cloudflare’s *Cloudforce One* threat report describes **infostealers** (e.g., **LummaC2**) stealing live session tokens to bypass MFA, heavy automation in credential abuse (bots dominating login attempts), and a ransomware initial-access pipeline increasingly tied to infostealer activity; it also notes a coordinated disruption effort against LummaC2 infrastructure and expectations of successor variants that compress time-to-ransomware. In parallel, AppSec commentary describes Anthropic’s **Claude Code Security** as a reasoning-based code scanning and patch-suggestion capability that claims to identify large numbers of previously unknown high-severity issues, but still requires human approval and does not replace production AppSec programs; other items in the set are largely non-incident thought leadership (skills gap, secure-by-design, AI security “tactics,” and workforce resilience), plus unrelated content (awards, job listings, quantum-resistant data diode product coverage, and an AI nuclear wargame study).
Jun 29, 2026
Threat actors are increasingly operationalizing AI and automation to scale attacks and exploit weak controls across both enterprise and consumer environments. An open-source offensive platform dubbed **CyberStrikeAI**—a Go-based “AI-native security testing” framework integrating 100+ tools—was observed in infrastructure used to target **Fortinet FortiGate** edge devices at scale; researchers linked activity to an IP (212.11.64.250) exposing a `CyberStrikeAI` banner and to scanning/communications patterns consistent with mass exploitation. Separately, a newly disclosed and rapidly patched **OpenClaw** vulnerability showed how AI agent tooling can be hijacked: researchers reported that a malicious website could take over a developer’s locally running agent due to inadequate trust-boundary validation, prompting urgent upgrades to **OpenClaw v2026.2.25+**. In parallel, a “vibe-coding” hosted app on the *Lovable* platform leaked data impacting **18,000+ users** after a researcher found **16 flaws (six critical)** tied to mis-implemented backend controls (including missing/incorrect row-level security in *Supabase*), enabling unauthorized access to records and actions like bulk email and account deletion. Criminal monetization also continues to evolve beyond AI-agent risks. **AuraStealer**, a Russian-language infostealer positioned as a successor/competitor after Lumma disruptions, was advertised on multiple underground forums and is supported by a sizable C2 footprint; analysis of 200+ samples identified **48 C2 domains**, with operators abusing low-cost TLDs (e.g., `.shop`, `.cfd`) and using **Cloudflare** as a reverse proxy to mask origin infrastructure. Broader reporting and commentary reinforced that identity and access failures remain a dominant breach driver and that AI adoption is expanding the attack surface via over-privileged agents and “shadow AI,” while ransomware operators increasingly target recovery paths (including backups) and dwell to corrupt restore points. Several items in the set were non-incident thought leadership or workforce content (skills gap, jobs listings, awards, and general AI security tips) and did not add event-specific technical details beyond high-level risk framing.
Jun 29, 2026
CrowdStrike’s 2025 global threat reporting says financially motivated intrusions are accelerating, with **average breakout time** (lateral movement after initial access) dropping to **29 minutes** and the fastest observed breakout time at **27 seconds**; the report also describes attackers increasingly using **social engineering**, **living-off-the-land** techniques, and abuse of **trusted systems** to move across *cloud, identity, enterprise,* and unmanaged device boundaries, alongside a reported **37% year-over-year increase** in cloud-focused attacks and a growing set of tracked adversaries (281 named groups plus additional activity clusters). Check Point Research’s 2025 retrospective similarly emphasizes that many 2025 operations relied on **familiar techniques combined in new ways**, highlighting themes such as early **ToolShell** exploitation assessed as Chinese-nexus activity against North American government targets and **identity-centric** intrusions (including **AiTM** credential theft) against US think-tank researchers. Several other items in the set are not about these annual threat-report findings and instead cover separate topics: Romania’s cyber chief warning that ransomware incidents against critical infrastructure may align with **Russian hybrid objectives**; sector-level reporting that **manufacturing** remains heavily targeted by ransomware due to IT/OT interconnectivity and downtime pressure; and US law-enforcement/FBI reporting on a surge in **ATM jackpotting** losses and related indictments. Additional entries are primarily **generic commentary, newsletters, or professional/educational content** (e.g., quantum-preparedness opinion, Enigma/RSAC history piece, a weekly video briefing, a malware-newsletter link roundup, a recon how-to article, and a governance/career feature page) and do not substantively corroborate the specific annual threat-report story.
Jun 29, 2026