CrowdStrike 2026 Threat Hunting Report tracks rise in AI-driven cyberattacks

CrowdStrike found AI being used in cyberattacks while AI supply chains, developer tools, and LLM access are also being targeted.

CrowdStrike's 2026 Threat Hunting Report found increased AI-related attack activity alongside attacks targeting AI infrastructure, software supply chains, cloud environments, and identity systems.

The report covers threat activity observed from July 2025 through June 2026 and draws on intelligence and telemetry collected by CrowdStrike, including data from its OverWatch managed threat-hunting team.

Presenting findings from the report, Adam Meyers, Senior Vice President of Counter Adversary Operations at CrowdStrike, said the company processes more than 7 trillion events per day. These are narrowed into about 14 million daily detection leads and roughly 36,000 annual customer notifications and alerts.

One area tracked in the report is activity generated by AI agents running within corporate environments. CrowdStrike recorded 2.5 times more detections associated with AI agent-driven behavior than human-triggered activity during parts of the first quarter of 2026.

Meyers said activity from tools such as Claude and Codex can be observed through endpoint process trees, allowing CrowdStrike to distinguish between human and automated activity. "What that allows us to do is to see detections not just from humans, but also detections triggered by machines and automation," Meyers said.

Threat actors are also using AI to support attack development. The report found adversaries generating scripts, payloads, and shell commands using AI, while compromised access to large language models was used in LLMjacking campaigns.

In one campaign, nearly 200,000 API requests were sent in two minutes through abused LLM access. Meyers also described cost harvesting, in which attackers use a victim's AI resources for their own purposes while leaving the victim responsible for the cost.

"AI is both the weapon and the target," Meyers said.

CrowdStrike also said North Korea-nexus FAMOUS CHOLLIMA weaponized trusted AI development environments to compromise cryptocurrency and blockchain companies.

AI supply chain risks

AI supply chains were another area of focus. In the first half of 2026, 87% of identified software registry threats involved malicious npm packages.

North Korea-nexus STARDUST CHOLLIMA injected a malicious npm package into 131 trusted Mastra AI frameworks. eCrime actor ALTERED SPIDER also compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments.

"The AI ecosystem is the next software supply chain battleground," Meyers said. The activity also extended to developer infrastructure, including CI/CD pipelines, container registries, software repositories, and IDE extensions.

Meyers said visibility across developer and cloud environments is important for detecting attackers as they move between systems. Referring to the ALTERED SPIDER activity, he said, "Every action that they took, we had a detection. We were able to notify the customers."

He also recommended delaying the adoption of newly released software dependencies rather than automatically pulling the latest version into production.

"Don't take the latest dependency," Meyers said. "Take last week's dependency."

Exploitation and identity attacks

CrowdStrike also recorded shorter timelines between vulnerability disclosure and exploitation. China-nexus actors VAULT PANDA and GENESIS PANDA launched attacks within 24 hours of disclosure, moving faster than the 48-hour proof-of-concept release-to-exploitation window tracked by the company.

Meyers said organizations will need more automation in vulnerability management as these timelines shrink. "We're going to have to move to some degree of automated remediation, whether it's automated patching or some other remediation action," Meyers said. "We can't wait a month."

He said patching priorities should also reflect exposure rather than treating every disclosed vulnerability the same way. A flaw on an externally accessible system, for example, presents a different level of risk from one located deeper inside a network and protected by additional controls.

"It really highlights the need for organizations to have good exposure management and visibility into what their exposures are," Meyers said.

CrowdStrike said roughly 48,200 Common Vulnerabilities and Exposures, or CVEs, were registered in 2025. The 2026 total had already reached about 43,000 before August, while around 7,400 CVEs were reported in June alone, representing a 96% increase from the same month a year earlier.

The report also recorded increased activity targeting cloud environments and identity systems. CrowdStrike recorded a 171% rise in cloud-conscious eCrime activity and a 15-fold increase in monthly device code phishing attempts during the first half of 2026.

Identity-based attacks also increased, with vishing intrusions doubling in the first half of 2026 compared with the second half of 2025. CrowdStrike said eCrime groups CORDIAL SPIDER and SNARKY SPIDER compromised single sign-on accounts and accessed SaaS applications to exfiltrate data.

In one incident involving SNARKY SPIDER, the attacker moved from account takeover to data theft in under five minutes. Meyers also described a CORDIAL SPIDER operation in which stolen credentials were used through a residential proxy before the attacker registered a new multi-factor authentication device within four minutes.

"You have less than five minutes to start acting before that threat actor is inside of single sign-on, inside of the cloud," Meyers said. "This is the speed at which modern adversaries are moving today."

The report also documented attackers moving across endpoint, identity, cloud, SaaS, and legacy infrastructure. ALTERED SPIDER, for example, was observed using stolen developer credentials to enter cloud environments, conduct reconnaissance, and move between systems.

Meyers also described a close-access operation involving devices left in hotel rooms by people attending a conference on Hainan Island, China. USB devices were used to boot targeted machines and install a remote-access tool referred to in the presentation as FlowCloud.

"This is something that I think organizations really need to consider when executives are traveling or subject-matter experts are traveling," Meyers said.