Loading story…
Microsoft’s 2026 Digital Defense Report says cyber risk is increasingly interconnected across identities, endpoints, cloud environments, applications, infrastructure, and software supply chains. Government agencies and services were the most targeted sector in Microsoft-observed activity, accounting for 27% between July 2025 and June 2026, up from 17% the prior year. Phishing represented 23% of observed intrusions, while compromised identities, exposed applications, social engineering, and legitimate administrative tools remained leading access paths; 52.2% of intrusions involving valid accounts resulted in additional credential theft.
The report assesses that attackers currently gain greater near-term advantage from AI, using it to accelerate reconnaissance, vulnerability discovery, phishing, malware and exploit development, and post-compromise activity. Microsoft warns that AI-assisted flaw discovery may outpace patch validation and deployment, reducing exploitation windows to less than 24 hours, and cites activity by China-, Russia-, and North Korea-linked operators, though attacks generally still require human direction. It recommends cross-domain telemetry correlation, rapid incident coordination and continuity planning, public-private intelligence sharing, and AI-agent controls covering identity, authorization, data and model security, prompt injection, agent memory, behavior, and revocation of access.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft released its 2026 Digital Defense Report, describing an interconnected threat environment and reporting that government agencies and services were the most impacted sector in its observed activity. The report assessed that attackers are already using AI across established attack workflows and currently gain a near-term advantage as AI-assisted vulnerability discovery and exploitation accelerate.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
mkd-cirt.mk
Open sourceblogs.microsoft.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Artificial intelligence is rapidly transforming the cyber threat landscape, with both financially motivated and nation-state actors leveraging AI to enhance the effectiveness and profitability of their attacks. According to Microsoft's Digital Defense Report 2025, phishing emails generated with AI are 4.5 times more likely to deceive recipients, achieving a 54% click-through rate compared to 12% for traditional phishing, and making phishing scams up to 50 times more profitable. Attackers are increasingly using AI not only to craft convincing phishing messages but also to automate multi-stage attack chains, including voice cloning and deepfake videos, which are being adopted by nation-state actors. The report highlights that AI contributed to the rise of ClickFix, which has become the most common initial access vector, accounting for 47% of attacks, surpassing phishing at 35%. Financially motivated operations now represent 52% of all known attacks, while only 4% are tied to espionage, indicating a shift in attacker priorities. Microsoft emphasizes that attackers are now 'logging in, not breaking in,' using AI-enhanced social engineering to compromise accounts through legitimate platforms. In the financial services sector, experts stress the need for robust prevention, detection, and response cycles, and recommend setting strict guardrails before deploying AI tools at scale. The distinction between AI models and AI agents is crucial, as the latter require more oversight due to their autonomous capabilities. Cloud misconfigurations remain a significant risk, underscoring the importance of security-first design in an era of AI-driven threats. The next 12–24 months are expected to see identity attacks, supply chain compromises, and AI-enabled adversaries as the dominant threats to financial institutions. Meanwhile, Chinese state-aligned threat actors have begun experimenting with AI-optimized attack chains, such as using ChatGPT and DeepSeek to generate phishing emails and enhance backdoor malware. However, early results suggest that the effectiveness of AI in the hands of less skilled actors may be limited, as demonstrated by the poor quality of phishing emails produced by the group known as DropPitch. Despite these shortcomings, the trend toward AI-driven cyberattacks is clear, and organizations are urged to adapt their defenses accordingly. The growing sophistication and accessibility of AI tools are expected to incentivize more threat actors to incorporate AI into their operations, raising the stakes for defenders across all sectors. Security leaders are advised to focus on collaboration, intelligence sharing, and continuous improvement of cyber resilience strategies to counter the evolving threat landscape. The convergence of AI with traditional attack vectors is reshaping the priorities and tactics of both attackers and defenders, making AI security a top concern for CISOs and security teams worldwide.
Jun 29, 2026
Major technology vendors and cybersecurity researchers are rapidly integrating artificial intelligence and automation into security operations, with Microsoft unveiling a comprehensive suite of AI-powered enhancements across its Defender ecosystem. These updates include proactive features such as Predictive Shielding for automatic attack disruption, a natural language Threat Hunting Agent, and expanded integration with third-party services like AWS and Okta. Microsoft is also addressing the growing challenge of non-human digital identities and agent sprawl, while expanding Security Copilot with dozens of new agents to automate tasks for security operations, identity, and IT teams. Meanwhile, the industry is seeing a surge in AI-driven detection engineering, with new and updated rules targeting advanced threats such as Windows defense evasion, credential access, phishing, and supply chain attacks. However, the adoption of generative AI models introduces new risks, as demonstrated by research into the Chinese DeepSeek-R1 model, which was found to generate insecure code—especially when prompted with politically sensitive topics. This raises concerns about the security implications of using foreign AI models, particularly those subject to state influence or censorship. Additionally, the threat landscape is evolving with the emergence of LLM-generated malware, adaptive AI-driven malware detection, and the use of AI in both offensive and defensive cyber operations. Security teams are urged to remain vigilant as AI technologies reshape both the tools available to defenders and the tactics employed by adversaries.
Jun 29, 2026
Booz Allen Hamilton and a senior Department of Defense cyber official warned that threat actors are using artificial intelligence to compress the cyberattack kill chain and operate faster than most organizations can detect, patch, and respond. The reporting says cybercriminal and state-backed groups are applying large language models and automated tooling to speed reconnaissance, vulnerability prioritization, exploitation, persistence, and scaling across many targets, with one cited example describing the open-source **HexStrike** framework exploiting thousands of Citrix NetScaler devices in under 10 minutes via a single critical `CVE`. Defense officials said the same trend is affecting the defense industrial base, where attackers are increasingly combining AI-assisted workflows with techniques such as living off the land and zero-day discovery. The warnings come as organizations impose stricter controls on AI use after security and operational failures tied to AI-assisted development and deployment. One cited example says Amazon now requires senior approval for AI-assisted code changes by junior and mid-level engineers after an outage and internal concerns over the blast radius of GenAI-generated modifications, while broader reporting points to exposed secrets, vulnerable code, and compromises involving AI platforms. Across the coverage, the common message is that defenders must move toward more automated, AI-assisted remediation and continuous exposure assessment, while preserving expert human review, secure engineering practices, and coordinated vulnerability disclosure to keep pace with machine-speed attacks.
Jun 29, 2026