Bengaluru: The CrowdStrike 2026 Threat Hunting Report has revealed that artificial intelligence (AI) is now deeply embedded across modern adversary operations, with cyber threat actors increasingly using AI to accelerate attacks, exploit software vulnerabilities, compromise AI infrastructure, and target enterprise AI systems.
The report highlights how attackers are exploiting vulnerabilities within hours of public disclosure while scaling attacks across software supply chains and cloud environments.
Released by CrowdStrike on August 3, 2026, the CrowdStrike 2026 Threat Hunting Report found that China-nexus adversaries exploited critical vulnerabilities within 24 hours of public proof-of-concept (PoC) releases.
Meanwhile, DPRK-nexus adversaries compromised 131 trusted AI framework packages, underscoring how AI has evolved into both an operational capability and a high-value target for cybercriminals.
According to the report, as enterprises continue integrating AI across business operations, adversaries are following the same trajectory by targeting AI infrastructure, abusing enterprise large language models (LLMs), compromising software supply chains, and pursuing AI workloads hosted in cloud environments.
This shift has created an operational environment where attacks move faster, scale more efficiently, and increasingly target AI systems that organizations depend on.
AI Emerging as a Tool, Target and Force Multiplier
The CrowdStrike 2026 Threat Hunting Report is based on frontline intelligence gathered by CrowdStrike’s threat hunters and intelligence analysts tracking more than 290 named adversaries worldwide.
Among its findings, the report states that threat actors are using AI to generate malicious payloads and shell commands while also exploiting AI infrastructure and abusing enterprise LLMs. In one observed campaign, attackers generated nearly 200,000 AI model requests within just two minutes.
The report also noted that CrowdStrike OverWatch observed AI agent-triggered detection leads growing at 2.5 times the rate of human-triggered detection leads, indicating that AI is significantly increasing both the volume and speed of suspicious activities that security teams must investigate.
AI Supply Chain Becomes a Major Target
The CrowdStrike 2026 Threat Hunting Report identifies the AI ecosystem as the next major software supply chain battleground.
According to the findings, DPRK-nexus threat actor STARDUST CHOLLIMA inserted a malicious npm package into 131 trusted Mastra AI frameworks.
The report further states that during the first half of 2026, 87% of identified software registry threats involved malicious npm packages.
Another threat actor, ALTERED SPIDER, reportedly compromised more than 300 software dependencies in a single day to steal credentials and gain access to cloud environments.
Also Read: Mindgrove, AtumX Launch AGNI, India’s First Chip-Powered Developer Board Built on Indigenous SoC
Vulnerability Exploitation Accelerates
The CrowdStrike 2026 Threat Hunting Report found that exploitation timelines have continued to shrink dramatically.
During the first half of 2026, 88% of CrowdStrike-observed exploitation of vulnerabilities with publicly available proof-of-concept code occurred within 48 hours of release.
The report adds that China-nexus adversaries VAULT PANDA and GENESIS PANDA launched attacks within 24 hours of public vulnerability disclosure.
Cloud-Based Attacks Continue to Rise
The CrowdStrike 2026 Threat Hunting Report also highlights significant growth in cloud-focused cybercrime.
According to the report, cloud-conscious eCrime activity increased by 171% as adversaries conducted credential theft, cryptomining, abuse of enterprise LLMs, and theft of digital financial assets.
The findings indicate that attackers are increasingly following enterprise AI workloads into cloud environments as organizations expand AI adoption.
Trusted Authentication Increasingly Targeted
The CrowdStrike 2026 Threat Hunting Report states that trusted authentication workflows are becoming an increasingly common attack vector.
The report found that vishing intrusions doubled during the first half of 2026.
It also states that eCrime groups CORDIAL SPIDER and SNARKY SPIDER compromised single sign-on (SSO)-integrated SaaS applications to conduct data exfiltration.
In one observed incident, SNARKY SPIDER progressed from account takeover to data theft in under five minutes.
Additionally, monthly device code phishing attempts increased 15 times during the first half of 2026, reflecting growing abuse of trusted authentication mechanisms.
Commenting on the findings, Adam Meyers, head of counter adversary operations at CrowdStrike, said:
“AI is now embedded in modern adversary operations. It is changing how attacks are planned, executed, and scaled while expanding the attack surface organizations must defend.
The organizations that succeed will secure AI as aggressively as they adopt it and use AI to defend at the speed of the adversary.”
The CrowdStrike 2026 Threat Hunting Report concludes that AI has become a central element of modern cyber operations, serving simultaneously as a tool for attackers, a target for compromise, and a force multiplier that is reshaping how cyber threats evolve across enterprise environments.
