According to CrowdStrike, vulnerabilities are being exploited increasingly faster and attacks are shifting toward AI infrastructure, software supply chains, and cloud environments.
Cybercriminals are not only increasingly deploying AI during attacks but are also actively targeting AI platforms and large language models (LLMs). This is evident from the 2026 Threat Hunting Report by CrowdStrike, in which the security specialist analyzes the evolution of the threat landscape over the past twelve months.
AI infrastructure under attack
In addition to traditional systems, attackers are increasingly targeting AI platforms themselves. According to CrowdStrike, 16 percent of all observed MITRE ATLAS techniques related to attacks against AI models or AI infrastructure. One example was a malicious Model Context Protocol (MCP) server that attempted to steal data from AI processes and forward it to an external server.
CrowdStrike also observed a new attack technique called LLMjacking. Attackers take control of corporate accounts that have access to large language models. In one case, attackers managed to obtain administrative privileges within a cloud platform. In just two minutes, they sent nearly 200,000 API requests to AI models.
Software supply chain remains a popular target
Attacks via software packages remain a major gateway. Malicious npm packages accounted for 87 percent of all attacks via software registries in the first half of 2026. Identity attacks also continue to rise. The number of vishing attacks, where victims are persuaded over the phone to disclose data, doubled in the first half of 2026 compared to the second half of 2025.
Additionally, cloud-related cybercrime rose by 171 percent. In one example, attackers stole cloud resources from an American technology company to mine cryptocurrencies. This generated approximately 41,000 dollars worth of Monero, while the configuration of the cloud environment was modified to make recovery more difficult.