CrowdStrike today released the 2026 Threat Hunting Report, revealing that AI is now embedded across modern adversary operations. China-nexus adversaries exploited critical vulnerabilities within 24 hours of public proof-of-concept (PoC) release, while DPRK-nexus adversaries poisoned 131 trusted AI framework packages, demonstrating how AI has become both an operational capability and a high-value target.
AI is now a tool, target, and force multiplier for adversaries. As enterprises embed AI across their business, adversaries are exploiting AI infrastructure, compromising software supply chains, abusing enterprise LLMs, and following AI workloads into the cloud. The result is a new operational reality: attacks move faster, scale more efficiently, and increasingly target the AI systems enterprises depend on.
CrowdStrike Threat Hunting Report Highlights:
Based on frontline intelligence from CrowdStrike’s elite threat hunters and intelligence analysts tracking more than 290 named adversaries, the report reveals:
- AI Is a Tool, Target, and Force Multiplier: Trusions increased by 2x in 1H 2026. eCrime groups CORDIAL SPIDER and SNARKY SPIDER compromised single sign-on (SSO) integrated SaaS applications for data exfiltration. In one incident, SNARKY SPIDER moved from account takeover to data theft in under five minutes. Monthly device code phishing attempts increased 15x in 1H 2026, reflecting growing abuse of trusted authentication workflows.
“AI is now embedded in modern adversary operations. It is changing how attacks are planned, executed, and scaled while expanding the attack surface organizations must defend,” said Adam Meyers, head of counter adversary operations at CrowdStrike. “The organizations that succeed will secure AI as aggressively as they adopt it and use AI to defend at the speed of the adversary.”