AI becomes both weapon and target in cyberattack surge
AI-powered cyberattacks surged 89% in 2025, CrowdStrike report reveals emerging threats
1Surge in AI-powered attacks
According to CrowdStrike's 2025 threat report, AI-enabled cyberattacks increased by 89% compared to the previous year. The report details how criminal groups and state-sponsored hackers are using AI throughout the attack chain. Particularly concerning is the LLMjacking technique where corporate credentials are stolen to access advanced AI APIs. In one case, hackers sent 200,000 API requests in just two minutes.
2North Korea's sophisticated methods
Famous Chollima, a sub-unit of the Lazarus Group, demonstrated the most advanced AI usage in late 2025 and early 2026. The group established complete fake companies with AI-generated websites, GitHub accounts and email infrastructure to conduct insider threat operations. Their supply chain attacks specifically targeted cryptocurrency and blockchain companies. Malicious scripts automatically executed commands when developers opened compromised repositories.
3Threats to software supply chains
AI supply chain compromise was the second most common MITRE ATLAS technique used for initial access. Famous Chollima's campaign against AI-focused development environments represented one of the most sophisticated implementations of this method. CrowdStrike's Meyers noted, 'AI systems are being targeted through their dependent supply chains and CI/CD pipelines.' This highlights critical vulnerabilities in modern development ecosystems.
4Financially motivated hacker groups
The group tracked as Altered Spider compromised over 300 software dependencies in a single day by targeting developers' AI tools. After harvesting credentials, they pivoted to cloud environments for theft and extortion. A CrowdStrike executive warned, 'They hit endpoints in seconds and are inside the cloud within minutes.' This speed is directly linked to vulnerabilities in software supply chains, creating urgent security challenges.
5Shrinking patch windows
AI helps attackers exploit newly disclosed vulnerabilities at machine speed. From January to June 2026, 88% of observed exploits using public PoC code occurred within 48 hours of release. China-linked groups like Vault Panda and Genesis Panda moved even faster, launching attacks within 24 hours of disclosure. CrowdStrike declared the traditional 30-day patch window 'completely obsolete,' with organizations now facing 24-48 hour response cycles.
6Record growth in software vulnerabilities
AI's effectiveness at finding code bugs has led to more CVEs being registered. While 2025 saw 48,200 CVEs, the first seven months of 2026 already reached 43,000. June alone recorded over 7,600 software vulnerabilities. CrowdStrike predicts the vulnerability ecosystem will dominate security discussions in coming months. System administrators race to fix flaws before malicious actors reverse-engineer patches.
7State-sponsored and financially motivated groups
CrowdStrike tracks over 290 adversary groups, adding about 10 new ones this year. Both nation-state actors and financially motivated criminals show similar increases in AI-triggered threats. The company's threat hunters track AI agent-triggered leads at 2.5 times the rate of human-triggered ones. This demonstrates how AI accelerates operational tempo across all threat actor categories.
8Critical warnings for organizations
The report emphasizes urgent measures to protect AI infrastructure, highlighting software supply chain security, CI/CD pipeline protection, and cloud activity monitoring. CrowdStrike notes adapting to 24-48 hour patch cycles presents major challenges but is essential. Financial institutions and critical infrastructure operators face particularly high risks. Proactive defense strategies must evolve as rapidly as the threats themselves.