Loading story…
Darktrace reported that cyber intrusions in the first half of 2026 increasingly targeted trusted relationships rather than relying mainly on malware or direct vulnerability exploitation. The company said attackers abused cloud entitlements, SaaS accounts, email authentication, software supply chains, remote administration tools, and non-human identities, making trust itself a primary attack surface. Phishing remained effective despite defensive controls, with roughly two-thirds of phishing emails passing DMARC and VIP users singled out in about a quarter of campaigns, while social-engineering lures became more tailored and text-heavy.
The report highlighted multiple incidents showing how trusted infrastructure is being weaponized, including a compromised SaaS account that enabled cross-layer malicious activity, supply-chain compromises involving Axios, Trivy, and Hola VPN, and infostealer distribution through blockchain infrastructure using malware such as StealC, AMOS, and Phexia. Darktrace also warned that enterprise AI adoption is expanding risk, citing LLM-generated exploitation of React2Shell, a compromised LLM proxy at an automation technology manufacturer, and broader exposure of sensitive data in prompts. It said attackers are moving faster as well, with a React2Shell honeypot compromised in under two hours and BeyondTrust exploitation observed in less than a day, while state-aligned actors linked to China, Russia, Iran, and North Korea continued using legitimate services for persistence, intelligence collection, and strategic positioning.
Get the infrastructure and lures behind it.
9 events from the most recent confirmed update back to the earliest known activity.
Darktrace published its mid-year 2026 threat update on August 3, reporting that cloud and SaaS environments had become top attacker targets in the first half of the year. The report emphasized a shift toward compromising trust relationships, identities, supply chains, and AI-related infrastructure.
Darktrace said security researchers highlighted JadePuffer in July as the first fully AI-generated ransomware campaign. The campaign involved an agentic threat actor exploiting a vulnerability in an internet-facing server before launching a fully automated ransomware attack.
Darktrace said threat actors hijacked the widely used Axios JavaScript library in April to distribute remote access trojans. The compromise abused trust in a heavily used software dependency and developer ecosystem component.
Darktrace reported a February–March campaign that delivered malicious payloads to devices using Hola VPN. The activity was later linked to an issue in Hola’s delivery pipeline, and Darktrace said it detected anomalous activity across multiple customers before a public advisory was released.
Darktrace reported that at an automation technology manufacturer, attackers used a compromised LLM proxy as a steppingstone to additional AI services before pivoting to cryptomining. The case illustrated AI infrastructure becoming both an attack surface and a trusted intermediary.
Darktrace reported that attackers used legitimate blockchain infrastructure during the first half of 2026 to distribute infostealers including AMOS and Phexia. The company said this approach helped threat actors inherit trust and broaden victim reach.
Darktrace described a case in the first half of 2026 where one compromised SaaS account led to inbox rule changes, phishing activity, and suspicious connections across email, SaaS, and network layers. It presented the incident as an example of attackers abusing trusted identities and platforms rather than relying on malware alone.
Darktrace reported a case in which an attacker used a large language model to generate working exploit code for React2Shell and deploy it at scale. The incident was cited as an example of AI-assisted offensive activity in the first half of 2026.
Darktrace said a purpose-built React2Shell honeypot deployed in early 2026 was compromised in less than two hours. It cited the incident as evidence of how quickly attackers operationalize newly disclosed vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
darktrace.com
Open sourceinfosecurity-magazine.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlight **social engineering and phishing** as primary initial-access vectors, with attackers increasingly targeting **identity systems** rather than exploiting software vulnerabilities. Microsoft was again the most spoofed brand in phishing during Q4 2025 (22% of observed brand-impersonation attempts), reflecting how attackers abuse trust in major identity and productivity platforms to harvest credentials; examples cited include lures mimicking Netflix account recovery, Roblox-related pages, and Spanish-language Facebook scams. Separately, an incident response case described payroll fraud achieved without malware or a network breach: an attacker impersonated employees to help desks, reset passwords, re-enrolled MFA, and registered an external email as an authentication method in **Azure Active Directory**, then altered direct-deposit details to redirect paychecks—underscoring how **help-desk processes and MFA reset workflows** can be exploited for persistence and financial theft. Targeted campaigns also show continued evolution in delivery tradecraft for **remote access**. A spear-phishing operation against Argentina’s judicial sector used ZIP attachments containing a weaponized Windows shortcut (`.lnk`) masquerading as a PDF plus scripts and a decoy court document to deploy a **Remote Access Trojan** while minimizing user suspicion. In parallel, research described **Pulsar RAT** (a Quasar RAT derivative) emphasizing stealth via **memory-only execution** and **HVNC**, with TLS-encrypted C2 and configuration retrieval from public paste sites, alongside persistence mechanisms such as scheduled tasks and UAC-bypass techniques. Another campaign attributed to **Konni APT** (“Operation Poseidon”) abused **Google and Naver ad redirection** (e.g., `ad.doubleclick[.]net`, `mkt.naver[.]com`) to launder clicks through trusted ad infrastructure before landing victims on compromised sites hosting malware, demonstrating how open-redirect and ad-tech trust can bypass reputation-based controls.
Jun 29, 2026
Recent reporting and vendor research indicate threat actors are increasingly prioritizing **identity-based intrusion paths**—notably phishing, credential theft, and **Business Email Compromise (BEC)**—over traditional vulnerability exploitation as the most common initial access vector. A Darktrace report cited by SC Media describes identity breaches as the leading entry point, alongside broader trends including accelerated breach tempo, increased automation, and “converging” tactics; it also notes exploitation can occur **before public disclosure** and that overall **CVE volume rose by 20%+ year-over-year**. Email remains a dominant delivery mechanism in these identity-first campaigns. Darktrace telemetry referenced by SC Media reported **32M+ high-confidence phishing emails** across its customer base, with many messages bypassing baseline controls (including **70% passing DMARC**), targeting executives, using **malicious QR codes**, and leveraging newly registered domains. Separately, a SOCRadar analysis frames the U.S. financial sector as a disproportionate target for phishing and dark-web activity, emphasizing AI-enabled crime, persistent BEC, and third-party/supply-chain risk, and citing metrics such as **~48% of global financial phishing activity** and **~23.5% of finance-related dark web threat activity** attributed to the U.S. market.
Jun 29, 2026
Security reporting and research highlighted how **AI and automation are reshaping both attacker tradecraft and defender operations**, while introducing new enterprise risk. ZDNET described research findings that **agentic AI implementations** from *ServiceNow* and *Microsoft* can be **exploitable**, warning that broadly permissioned agents could enable **lateral movement and privilege escalation** across systems of record if an attacker compromises an agent or chains between agents with different access levels; a **least-privilege** posture for agents was emphasized. Dark Reading separately reported that **AI agents are increasingly augmenting—and in some cases supplanting—human penetration testing** for “low-hanging” vulnerabilities, but that **false positives and the need for human oversight** remain material constraints as agentic testing matures. Threat-intelligence coverage also underscored the **industrialization of cybercrime** and the ecosystems enabling it. CloudSEK detailed the evolution of the English-speaking cybercriminal milieu known as **“The COM,”** tracing its roots in OG-handle trading communities and forum migrations into a service-oriented underground linked to groups such as **Lapsus$**, **ShinyHunters**, **Scattered Spider (UNC3944)**, and **Silent Ransom Group**, and associated activity spanning breaches, extortion, SIM swapping, ransomware, and crypto fraud. SC Media’s commentary similarly described a cyber underground where criminals can readily buy capabilities (credentials, tooling, automation), calling out techniques including **carding** and **ClickFix** social engineering that tricks users into running copied commands to install infostealers. Separately, Dark Reading reported allegations that the **Chronus Group** posted **2.3TB** of purported Mexican government data affecting up to **36 million** people, while Mexico’s **ATDT** disputed it as largely **repackaged data from prior breaches** and said no new sensitive accounts were identified and that impacted systems were primarily **obsolete, third-party-administered** state-level platforms.
Jun 29, 2026