Sectoral impact

The sector-attributed data highlights a critical concentration of threat activity directed toward vital operational networks. Transportation and shipping and telecom together absorb over half of all detected campaign volume, reflecting an intense focus on intelligence collection across logistics, global supply chains, and communications backbones. Threats targeting these core infrastructures pose a systemic risk, as disruptions or compromise within these verticals can cascade into broader economic and operational impacts.

Furthermore, the persistent targeting of government, media and communications, and business services points to a multifaceted espionage strategy. Threat actors appear focused on obtaining strategic geopolitical insight, disrupting public communications, and exploiting third-party business services to facilitate downstream access to high-value targets.

During the second and third quarters of 2026, the cybercriminal relationship with AI matured from the integration threshold crossed in the prior period into something closer to delegation. This period is defined by two developments: AI agents increasingly act with little or no human direction, and agentic malware capable of autonomous decision-making is emerging. This section presents key findings from underground forums and marketplaces, examining the ongoing evolution and growing sophistication of cybercriminal AI offerings.

Underground marketplaces mirror this maturation and have split into the so-called two tiers. A saturated low-cost tier of uncensored chatbots and jailbreak wrappers, exemplified by MadGPT, lowers the barrier to entry for unskilled actors but delivers inconsistent quality and draws open skepticism from buyers. A smaller and far more expensive tier of autonomous agents, exemplified by Nexus Code and the offering from the actor catboyBF, promises to plan and execute whole intrusions with minimal human oversight. 

Compared with the prior six-month period, where the equivalent underground offerings were mostly crypters and pentest utilities, the current market sells working autonomy. The pricing gap between the two tiers, running from ten dollars a month to thousands, is itself an intelligence signal about where genuine capability is concentrated.

TITAN AI ransomware as a service

The TITAN AI operation, advertised by the TITAN team on a top-tier Russian-language forum in late June 2026, reframes what AI ransomware means. Rather than using AI to write the encryption payload, TITAN markets AI as the engine of extortion itself. The group describes an automated factory that ingests a victim's stolen documents and classifies them by sensitivity, maps relationships between counterparties and offshore shell entities, scans financial records as far back as 1998 for evidence of tax evasion and falsified invoices, and then calculates a ransom demand pegged to the victim's actual financial and legal exposure. 

Most striking is a module that auto-generates jurisdiction-specific regulatory analysis across more than fifty frameworks and drafts notification packages addressed to tax authorities, data protection regulators, financial intelligence units, and the media:

The technical framing is grandiose, with claims of accelerated bare-metal inference running custom models, and the posting did not disclose affiliate splits or subscription pricing. Whether every claim is genuine, the strategic intent matters, and it signals an escalation in underground ambition. In the prior six-month period, the most-advanced AI listings offered evasion and intrusion, such as a metamorphic crypter that used AI to generate polymorphic variants and a tool advertised as APT-level penetration testing. 

TITAN AI pushes that ambition into automated extortion economics, a function absent from the previous period's listings. It is extortion by automated compliance threat, and it aligns with the broader shift this period toward using AI to intensify, not merely accelerate, attacks.

By combining automated compliance analysis with multijurisdictional regulatory mapping, TITAN AI RaaS demonstrates a dramatic leap in threat actor capabilities. Automating regulatory triage across dozens of frameworks eliminates human bottlenecks, enabling actors to instantly synthesize complex corporate records into weaponized, multi-agency ransom notification packages at operational machine speed. This shift toward autonomous extortion economics renders traditional, human-paced incident response obsolete, forcing organizations to adopt automated governance and real-time defense strategies to counter machine-speed blackmail schemes.

MadGPT and the uncensored chatbot tier

MadGPT was the most visible example of the crowded uncensored language model category, promoted continuously from late August 2026 through the end of the period on a popular underground forum, with delivery through a web platform, a Telegram bot, and a VS Code extension offering an agent mode. It is marketed as fully unrestricted and as an aggregator of several models rather than a single proprietary one. Its advertised use cases range from writing scrapers, auto-registration tools, and account checkers to finding SQL injection flaws that mainstream models refuse to analyze, to generating landing pages and spam bots from a single prompt.

What makes MadGPT instructive is the reaction it drew. Darkweb forum members publicly accused the vendor of reselling a worthless old jailbreak wrapper with a stale knowledge cutoff and refused to pay the roughly $150 asking price, while the threat actor denied any lineage to older tools and steered critics toward a free trial.

Compared with the prior six months, when uncensored tooling was sold mostly as crypters and generation services, this tier is now saturated and commoditized with uncensored chatbots such as MadGPT, MessiahGPT, DarkGPT, and buyer skepticism is far more visible. This exchange captures the period's defining market dynamic: demand for uncensored AI is high, but trust is low, and vendors increasingly compete on proof rather than promises.

The underground picture is corroborated by observed activity, including an operation that distributed coin miners and the SalatStealer infostealer through archives impersonating AI tools, and a lure that delivered the SmartRAT banking trojan through fake Brazilian bank sites, both showing exactly the kind of commodity, model-drafted output that cheap chatbots exist to produce.

Nexus Code and AI autonomous agent

Two offerings exemplify the premium, agentic end of the market, where the pitch is no longer a chatbot but a tool that does the work itself. NexusCode, promoted by the user NexusCode, is sold as a local Windows application rather than an AI chat service. The user describes a task in plain language, and the agent plans it, writes the code, tests it inside a virtual machine, and delivers a finished build.

Its advertised repertoire covers RAT across several languages, crypters with a unique stub per build, antivirus and endpoint evasion through unhooking and AMSI and ETW bypass, full exploit development including protection bypass and patch diffing, and end-to-end pentest automation from a single URL. The actor leans on a self-verification narrative, claiming the agent reproduces every exploit in a sandbox before handover, and sells on a software-as-a-service model with a free trial, an elite tier at five thousand dollars per month, anonymous cryptocurrency top-ups, and a vouch program:

A separate offering, advertised by the actor catboyBF on a prominent forum in early September, pushes the autonomy claim further. The actor describes a fully autonomous agent that finds hosts, finds vulnerabilities, exfiltrates, and cleans up. It uses internet-wide scanning to discover vast numbers of targets, automatically conducts reconnaissance and exploitation, hunts for zero-day vulnerabilities in source code, and deploys malware or ransomware when conditions are met. Unlike its peers' subscription model, this agent was sold as source code only for a negotiable $250, without the API keys needed to run it, since it relies on a list of free third-party model providers such as OpenAI, Anthropic, X AI, DeepSeek, and Nvidia, among others.

The significance of this tier is best seen against the prior period. Six months earlier, the underground offered APT-level automated penetration testing as a product to buy. The current period delivers working autonomous agents with trials, tiered subscriptions, and live demonstrations. In short, where the previous period's AI was something you bought to assist you, the current period's is something you buy to act for you.

The observed record confirms the model is already in the field. Open source harnesses have autonomously compromised online retailers over a span of days and, in one instance, destroyed a victim's data when the agent's own cleanup dropped its database tables. The same Hermes Agent framework appeared in autonomous crypto theft and mass WordPress compromise, in an intrusion against a government institution in a South Asian country, and in the Carbonato docker botnet built for autonomous propagation and cryptomining.

The ClosedQuorum implant, which polls DeepSeek, Qwen, Mistral, and Gemini and acts on a plurality vote with no dedicated control server, and Neural Override, a model-driven remote access trojan that autonomously selected ransomware, credential theft, and SCADA tasking actions, round out a picture in which the autonomy sold in forums is being observed in practice.

The emergence of NexusCode and autonomous AI agent offerings signals a fundamental transition in the cyberthreat landscape toward full machine-speed operational execution. By moving beyond advisory models to software capable of independent target discovery, exploit validation, exfiltration, and cleanup, these capabilities drastically compress attack timelines and lower technical barriers. Looking forward, the derivative adoption of autonomous decision-making engines across cybercriminal networks will likely drive higher-volume, highly adaptive campaigns that challenge existing, human-reliant security postures.

Implications and recommendations

The transition from AI-assisted drafting to autonomous operational execution and agentic malware requires security teams to re-evaluate defense architectures across four major areas:

• Agentic malware and autonomous intrusions: Threat actors now deploy autonomous agents and frameworks (e.g., Hermes Agent, ClosedQuorum, NexusCode) that independently target, identify vulnerabilities, exploit, and clean up at machine speed without continuous human direction.
• Automated compliance extortion: Ransomware operations like TITAN AI leverage dedicated NLP pipelines to rapidly parse stolen documents, calculate maximum regulatory liabilities across dozens of global frameworks, and automatically draft multi-agency disclosure packages to maximize pressure.

Strategic defensive recommendations:

• Implement machine-speed behavioral defense: Shift detection strategies from human-paced cadence logs and static signatures to real-time anomaly detection that can identify autonomous agent activity, consensus voting implants, and metamorphic execution.
• Harden automated data governance and regulatory tracking: Audit internal data holdings and sensitive documentation to proactively map potential compliance exposure before automated extortion tools like TITAN AI can synthesize them into weaponized regulatory reports.
• Secure local and external AI infrastructure: Monitor and restrict outbound traffic to public AI provider endpoints, audit developer API keys, and secure developer environments to block agentic frameworks from leveraging third-party model providers for C2 or autonomous tasks.
• Compress incident response playbooks: Update emergency protocols to counter sub-hour intrusion timelines, replacing manual approval checkpoints with automated containment controls where autonomous agent activity is detected.
• Prioritize intelligence on premium autonomous offerings: Focus security monitoring on high-cost, validated threat actor agents (e.g., NexusCode) and open-source harnesses over low-cost, commodity jailbreak chatbot noise.

Every AI coding and operations agent runs the same loop: it writes a shell command, executes it, reads the output, and writes the next command. This design is what makes agents useful, but it is also a credential-handling model that was never deliberately chosen. To complete ordinary tasks, agents routinely move secrets out of encrypted OS stores and down a path of increasing exposure—onto command lines, into local files, and finally off the machine into an external model provider's context window, where they may be permanently logged.

What is unique to agents is where the secret ends up. A developer's mistake tends to stay local—on disk or in a terminal. An agent's operation packages the credential into the prompt and transmits it to an external model, crossing the boundary of the environment entirely. Operating systems work to keep secrets on the most protected steps—encrypted and in memory; agents, simply to get their work done, constantly force them down to the exposed ones. We call this systemic, accidental exposure the unseen credential surface.

The exposure classes

Agent credential exposure is not exotic. Trellix Trellix Advanced Research Center groups it into a set of recurring classes, each a normal engineering task—authenticate to an API, run a migration, install a dependency—issued as a command the agent runs on its own. They share two properties: Each moves a credential down the path of increasing exposure, and each runs through a trusted binary the environment executes thousands of times a day for legitimate reasons. 

Representative classes include credentials passed as command-line arguments (MITRE ATT&CK T1552; ATLAS AML.T0055), reading credential files such as `.env` and cloud config (MITRE ATT&CK T1552.001; ATLAS AML.T0055), and extraction from credential stores and cloud secret managers through their official interfaces (MITRE ATT&CK T1555 and T1555.006; ATLAS AML.T0098). The remaining classes span environment-variable harvesting, disabled transport verification, off-machine egress, obfuscated execution, shell-startup persistence, and the bootstrapping of new passphrase-less credentials. Each maps to specific MITRE ATT&CK and ATLAS techniques.

When exposures chain

Real agent activity rarely occurs one class at a time. A single mundane request can produce one command that drags a secret down the entire path—exporting cloud credentials as command-line arguments (MITRE ATT&CK T1552; ATLAS AML.T0055), calling a secret manager to read a database password (MITRE ATT&CK T1555.006; ATLAS AML.T0098), and using that password to query production (MITRE ATT&CK T1078). No individual step is unusual; the agent is not selecting techniques from a menu but cascading through them naturally to complete the work. The decisive factor is speed: a human engineer stringing these steps together takes minutes, while an agent chains them in seconds. The true exposure is not any one step but the full chain, executed faster than any analyst can follow—collapsing the window a SOC has to notice and respond to near-zero.

Why single-event detection fails

This is structural, not a tuning problem—a living-off-the-land pattern in which every technique uses a trusted, signed, everyday tool, and the same command looks identical regardless of who issued it: developer, agent, or intruder. The signal that would separate legitimate from malicious use is usually not present in the event itself. Two forces compound this: prompt injection (ATLAS AML.T0051) can redirect the agent's existing capabilities toward exfiltration (ATLAS AML.T0086) without any new foothold, and obfuscated execution (MITRE ATT&CK T1027) hides the real action from monitoring. The limit is not telemetry quality but the unit of analysis—viewed as a sequence of credential access, use, and egress attributed to the originating agent process, the ambiguity largely disappears.

Implications and recommendations

The root cause is architectural, so the response must be too: Keep secrets on the most-protected steps, or make an exposed secret worthless quickly. Organizations should:

• Make credential lifetime the lever. Enforce short-lived, just-in-time tokens so a leak becomes a harmless, expired event.
• Keep secrets off the exposed steps. Broker credentials in-process, pass them via stdin or scoped file descriptors rather than the command line, and redact credential-shaped strings before they enter the LLM context window.
• Re-tier the asset and isolate the network. Treat any endpoint running an AI agent as the high-value, secret-handling infrastructure it has become, and tightly restrict its network egress.
• Correlate on process lineage. Adopt security tooling that can tie credential access, command execution, and network egress back to the originating agent process. Single-event rules cannot separate agent activity from attacker activity.

Six months ago we characterized the vulnerability landscape as exploitation "at the extremes," record disclosure volume meeting a collapsing interval between disclosure and weaponization. The April to September 2026 data sharpens that picture into what our own sensors recorded, and three strands stand out. The exploit detections we see in volume still point overwhelmingly at known, already-patchable vulnerabilities, led by internet-facing infrastructure such as F5 BIG-IP. Alongside that familiar pattern, more recent application-framework flaws are already generating detection activity on the scale of long-standing bugs. And at the leading edge, AI-orchestration and Model Context Protocol (MCP) tooling has become a target class that external research confirms is being exploited, even as our own telemetry shows little of it yet. The three carry different evidentiary weight, and this report treats them accordingly.

The throughline is the flaws generating the most exploit detections are disclosed, cataloged as exploited, and with few exceptions, long patched at the vendor. In our Trellix NX and Trellix Helix telemetry, the names at the top are years old and well understood: F5 BIG-IP (2022), Apache HTTP Server (2021), Log4Shell (2021), and Atlassian Confluence (2022), now joined by React2Shell (CVE-2025-55182). For defenders, the encouraging corollary is that the highest-value remediation targets are mostly already known and fixable, a tractable problem obscured by disclosure noise.

That noise is considerable. In its June 2026 forecast, The 2026 Vulnerability Forecast Update: Navigating the AI Epoch, FIRST raised its full-year 2026 projection from a February median of 59,427 CVEs to approximately 66,000, roughly an 11% increase, attributing the revision partly to AI-assisted discovery. Within our April to September window, the NVD published 58,583 CVEs. Against that volume, confirmed exploitation is far narrower: CISA added 175 CVEs to its Known Exploited Vulnerabilities catalog during the window; newly confirmed-exploited entries, not a tally of every CVE exploited. The same triage pressure shows up in policy: In 2026, the NVD adopted risk-based enrichment, prioritizing CVEs in the CISA KEV catalog, in federal-government software, or in designated critical software, and deferring the rest.

The AI frontier rounds out the picture. Trellix has shipped detection coverage for a cluster of AI-orchestration and MCP flaws, and external researchers have documented early exploitation of several; because our own exports show only limited activity so far, we treat it as a frontier to watch rather than a Trellix-observed trend.

The entrenched edge: Long-lived flaws on internet-facing infrastructure

The most consistent signal in our exploitation telemetry is that attackers concentrate on known, already-disclosed vulnerabilities, most heavily on perimeter and application-delivery infrastructure, but also in widely deployed application libraries and, this period, a newly adopted web framework. The flaws driving the volume are, with few exceptions, neither obscure nor unpatched at the vendor. The pattern spans decades-old appliance bugs and December 2025 framework RCE alike.

F5 BIG-IP anchors the pattern. Viewing our Trellix NX detection trends, CVE-2022-1388, an iControl REST authentication bypass leading to remote code execution, is the most-detected exploit CVE in the dataset at 1.2M detections, and the F5 BIG-IP product is the most-targeted application overall at 1.5M detections, 5.0% of the filtered total. Trellix Helix corroborates the signal from a different detection pipeline, ranking the same CVE among its top exploit rules (5.3K detections across the two quarters). CISA has listed CVE-2022-1388 as known-exploited since May 10, 2022, with a known-ransomware-use designation; its FIRST EPSS score was 0.9995 as of September 30, 2026. The practical reading is that a four-year-old flaw, with a long-available patch and confirmed criminal use, remains the busiest exploit target our filtered network view records.

The concern is not a single CVE but the entire appliance class. The F5 stack recurs through our Trellix NX telemetry rankings—CVE-2023-46747 (174K detections), CVE-2021-22986 (76K), and CVE-2020-5902 (66K)—and is accompanied by the wider edge-and-VPN cohort: Fortinet FortiOS CVE-2018-13379 (1110K), Check Point CVE-2024-24919 (62.1K), Pulse Secure CVE-2019-11510 (55.3K), and Palo Alto Networks GlobalProtect CVE-2024-3400, itself a top hit in our Trellix Helix telemetry. Every one of these edge CVEs is on the CISA KEV catalog with a known-ransomware-use designation.

Persistence beyond the perimeter: Log4Shell

The entrenched-flaw pattern is not confined to network appliances. Log4Shell (CVE-2021-44228), a flaw in the ubiquitous Apache Log4j logging library, registers 140.3K detections in our Trellix NX telemetry. It also appears among the top Trellix Helix exploit rules triggered. Nearly five years after disclosure, a widely deployed library flaw still generates detections across all three datasets. This is a concrete reminder that for internet-facing software, "patched upstream" and "no longer generating detections" are entirely different conditions.

A more recent framework under heavy fire: React2Shell

The known-vulnerability pattern isn't limited to years-old flaws. React2Shell (CVE-2025-55182), a pre-authentication RCE in Meta's React Server Components, CISA KEV-listed since December 5, 2025, with a known-ransomware-use designation, continues generating some of the heaviest detection volume in our data. It records 214K detections in the Trellix NX telemetry, 1.02M alerts in our Trellix IPS telemetry, and is a top Trellix Helix exploit rule triggered (6K detections), one of the few rules rising across the quarter.

A cloud-native exception worth watching

The second-most-detected exploit CVE in the Trellix NX dataset is not an edge appliance at all. "IngressNightmare" (CVE-2025-1974), an unauthenticated path to code execution and cluster-secret disclosure via the ingress-nginx admission controller for Kubernetes, disclosed by Wiz in March 2025, recorded 471K detections. It is not on the KEV catalog, though its EPSS score was 0.994 as of September 30, 2026. The honest characterization is that this is a disclosed, high-severity flaw with a high model-estimated exploitation probability and heavy probing in our telemetry, but without a CISA confirmation of in-the-wild exploitation. Its prominence signals that attacker reconnaissance now reaches Kubernetes ingress infrastructure—specifically the ingress-nginx admission controller, a privileged component whose compromise can expose cluster secrets —and it is a candidate to watch in the next period.

An emerging frontier: AI-orchestration and MCP vulnerability risk

Beyond the known-vulnerability battleground, a genuinely new target class took shape this period: the software that operationalizes large language models—AI-orchestration tools, low-code builders, and the Model Context Protocol (MCP) servers that wire agents to tools and data.

External research already puts exploitation of this surface beyond doubt. Two AI-tool flaws reached CISA KEV within the reporting window—and because a KEV listing marks when CISA cataloged reliable evidence of in-the-wild exploitation rather than when exploitation began, the listing date and the exploitation date are not the same thing. LiteLLM (CVE-2026-42271) is the more consequential: Its MCP test endpoints accepted server configurations containing command fields, letting a user with a valid proxy API key—potentially a low-privilege one—run commands on the host. CISA added it to KEV on June 8, 2026, confirming exploitation of a flaw in MCP-adjacent tooling, albeit privileged-abuse rather than a fully unauthenticated path. For Marimo (CVE-2026-39987), a pre-authentication RCE KEV-listed on April 23, 2026, the timing is pinned down independently: Sysdig's Threat Research Team observed the first in-the-wild exploitation attempt just 9 hours and 41 minutes after the advisory was published in April 2026, though on honeypot nodes Sysdig deployed across cloud providers, which demonstrate the speed of opportunistic attempts, not the compromise of any production organization. (Sysdig speculates that attackers may be using AI to weaponize advisories; it offers no direct evidence for this campaign, and we make no such claim.) The pattern is not brand new: Before our window, Langflow (CVE-2025-3248) was KEV-listed in May 2025, and Trend Micro documented a campaign deploying the Flodrix botnet through it that June—prior-year proof that unauthenticated RCE in AI tooling can translate into real botnet recruitment.

Trellix NX provides detection coverage for selected vulnerabilities affecting AI development platforms, orchestration frameworks, and Model Context Protocol (MCP) integrations. These include Nginx-UI MCP (CVE-2026-33032), Flowise's custom MCP node vulnerability (CVE-2025-59528), Spring AI's SpEL injection flaw (CVE-2026-22738), and Microsoft 365 Copilot's EchoLeak prompt-injection vulnerability (CVE-2025-32711). Collectively, these vulnerabilities illustrate the expanding attack surface of AI-enabled applications, with potential consequences ranging from unauthorized command execution to sensitive information disclosure through manipulated AI workflows. As organizations increasingly integrate AI capabilities into enterprise environments, securing exposed interfaces, restricting application privileges, and monitoring for exploitation attempts will be essential to limiting their impact.

Movement across the quarter: Reading the Trellix Helix detection telemetry

Because Trellix Helix reports exploit-rule detections by quarter, our telemetry can show how detection volumes moved between Q2 and Q3, a view most datasets cannot provide. The movement is uneven: Detections against most classic public-facing N-day flaws fell, while two rose.

At the technique level, Trellix Helix detections mapped to ATT&CK T1190 (Exploit Public-Facing Application) fell from 44,137 to 30,859 quarter over quarter, consistent with the broad decline across the table above.

The practical lesson is to track observed activity over time rather than treat every cataloged flaw as equally pressing. These remain movements in our own detection volume, which can shift for many reasons—scanning patterns, changes in detection content or sensor deployment, the ebb of opportunistic activity—so a decline is not evidence that exploitation is falling industry-wide, and a ~7% rise is a cue to monitor, not a surge. We draw no inference about attacker intent from the counts.

Implications and recommendations

The findings point to three complementary defensive postures, weighted to the evidence behind each.

For known-vulnerability exposure, treat internet-facing appliances and recently adopted frameworks as high-value assets under sustained, KEV-confirmed exploitation pressure rather than routine patch line-items. The most-detected exploit CVE in our network view is a four-year-old, KEV-listed, ransomware-associated F5 vulnerability, and the surrounding edge cohort (Fortinet, Check Point, Citrix, Palo Alto, Pulse) shares that profile—but a December 2025 framework RCE, React2Shell, already sits alongside them near the top of observed detection volume, so the same urgency must extend to fast-moving application frameworks and libraries such as Log4j. Where immediate patching is not possible, prioritize compensating controls—virtual patching, management-plane isolation, and network segmentation—so that a compromised asset is contained rather than catastrophic.

For prioritization at scale, anchor remediation to evidence of exploitation rather than to disclosure volume. With disclosure now running to tens of thousands of CVEs per quarter, we recommend combining the CISA KEV catalog—which grew by 175 newly confirmed-exploited entries during the window—with FIRST EPSS to focus effort on what is demonstrably or probably dangerous. This reflects the same spirit of risk-based triage that led NVD to prioritize CVEs in CISA KEV, in federal-government software, and in designated critical software for enrichment—though the specific KEV-plus-EPSS combination is our analytical recommendation, not NVD's enrichment criteria. Treat EPSS as a forward-looking probability, not proof that a flaw has or has not been exploited, and treat KEV additions as newly confirmed entries rather than a tally of all exploitation.

For the emerging AI frontier, bring the AI application stack into vulnerability-management scope now—informed by external exploitation evidence (the KEV listings for LiteLLM and Marimo and the Flodrix campaign against Langflow), even though our own telemetry shows only limited activity so far. Acting ahead of observed volume is the point: Inventory these components—orchestration frameworks, low-code builders, vector stores, and MCP servers—and apply the controls expected of any other internet-reachable service: authentication, network isolation, and egress restrictions.

Finally, treat long-lived, known-exploited flaws as a standing condition, not a backlog that will clear. Years-old vulnerabilities, from edge-appliance bugs to a ubiquitous library flaw like Log4Shell, continue to generate detections across our datasets long after fixes exist. Durable mitigation is architectural—reducing attack surface, segmenting networks, and retiring or isolating unpatchable legacy systems so inevitable contact with a long-lived flaw is absorbed rather than amplified.

The following section is derived from industry reporting and reflects information on publicly reported events and campaigns. These insights are not based on Trellix detections or direct observations, but are included for contextual awareness and to provide a broader view of the threat landscape and what our industry peers are tracking.

The analysis of industry reports provides a comprehensive overview of the global cybersecurity landscape from April to September 2026 (Q2 and Q3).

The period was characterized by three converging shifts: AI moved from a development aid to an operational tool; software supply chain attacks became self-propagating; and identity, not the endpoint, became the primary target for initial access. Threat actors increasingly abuse trusted platforms, legitimate authentication flows, and the developer toolchain itself, leaving defenders with fewer malicious artifacts to detect.

Key findings

AI Becomes an Operational Weapon

The share of campaigns referencing AI or large language models (LLMs) roughly doubled, from 5.3% to 10.4%. Early in the period, AI mostly accelerated development, including the AI-built Montana Empire phishing kit and the Bissa Scanner operation, which used AI tooling to exploit React2Shell (CVE-2025-55182) across more than 900 organizations. By Q3, actors were running AI agents operationally: One financially motivated actor used open-source AI harnesses (Strix, Cairn, and Hermes) to autonomously compromise hundreds of online retailers, and a Chinese-speaking operator orchestrated multiple LLMs against government and education targets across Asia. Adversaries also target AI ecosystems directly, with malicious OpenClaw skills, fake MCP servers, poisoned Hugging Face models, and indirect prompt injection (IPI) payloads planted on live websites.

Self-propagating Supply Chain Worms

Developer supply chain attacks continued to grow, rising from 9.1% to 11.9% of campaigns, and became markedly more automated. The Mini Shai-Hulud and Miasma worm waves, largely attributed to TeamPCP, compromised official npm and PyPI packages from SAP, TanStack, and Red Hat by abusing CI/CD publishing workflows, then reused stolen tokens to spread further. In one case, a Shai-Hulud CI/CD compromise led directly to an AWS Redshift breach. TeamPCP also partnered with the Vect ransomware operation, blurring the line between supply chain intrusion and extortion. North Korea's UNC5267 kept up its Contagious Interview campaign, which spanned five package ecosystems (npm, PyPI, Go Modules, crates.io, and Packagist), and one tracked wave alone produced 108 malicious npm packages in 31 days.

Identity Attacks That Bypass MFA

Device code phishing surged, with OAuth or device code abuse appearing in 2.7% of campaigns, up from 1.3%. Phishing-as-a-Service (PhaaS) kits such as Kali365, EvilTokens, and Forg365 abuse Microsoft's legitimate OAuth device authorization flow to steal Entra ID tokens, bypassing passwords, multifactor authentication (MFA), and passkeys. In parallel, UNC6671 (BlackFile) ran voice phishing campaigns that impersonated IT staff to compromise single sign-on (SSO) and Microsoft 365 environments, rotating through extortion brands including Redact, Pink, and Trellix Helix.

ClickFix Goes Cross-platform

"Pull" social engineering kept growing, with ClickFix and fake CAPTCHA lures appearing in 9.1% of campaigns, up from 6.3%. Lures now include fake AI tool installers (Claude, Gemini CLI, and PureClaw), short-form social media videos disguised as tech tips, and Ethereum-hosted delivery via EtherHiding. macOS is now a primary target: the share of campaigns targeting macOS rose from 7.9% to 12.5%, delivering Atomic MacOS Stealer, MacSync, and SHub Stealer through ClickFix pages, malicious Google ads, and even shared AI chat links.

Rapid Exploitation of Edge and Enterprise Software

Campaigns involving VPNs, firewalls, and other edge infrastructure rose from 9.6% to 13.6% of the total. Highlights include zero-day exploitation of Cisco Catalyst SD-WAN Manager (CVE-2026-20245), the FIRESTARTER backdoor on Cisco Firepower devices, Palo Alto Networks exploitation leading to Qilin ransomware (CVE-2026-0257), and multiple Chinese state actors rapidly adopting the BlueMoon Chrome and Windows zero-day chain.

Geopolitical Espionage and Destruction

Iran-linked actors (MuddyWater, Agrius, Tortoiseshell, and the Handala persona) combined espionage with destructive operations against Israel and the United States, including targeting of backup and recovery layers. Russian actors (APT28, Turla, and Laundry Bear) focused on Western governments, defense, and Zimbra mail servers, while China-nexus groups expanded Operational Relay Box (ORB) networks and targeted governments across Southeast and Central Asia.

Top 10 statistics

Percentages show each entry's share of all references in its category.

Comparison with previous six months

The US strengthened its position as the most targeted country, rising from 6.8% to 8.0% of country references. India, Brazil, and Canada held their positions, while Australia, France, and Spain gained ground and Russia and China dropped out of the top 10.

Sector targeting changed most visibly. IT and technology overtook government, which fell from first place (10.8%) to fourth (6.1%). Programming and development entered the top 10, reflecting the surge in developer supply chain attacks, while manufacturing, education, defense, and energy dropped out.

Threat categories confirm the shift toward data theft and developer targeting. Information stealers appeared in 60.5% of campaigns, up from 56.5%, and supply chain attacks rose from 9.1% to 11.9%. The share of campaigns involving worms more than doubled, from 1.3% to 3.0%, with roughly half linked to the Shai-Hulud and Miasma package worms and their offshoots. Attackers broadened beyond Windows: Linux rose from 12.1% to 18.1% of campaigns and macOS from 7.9% to 12.5%, while Windows held steady at about half of all campaigns. The share of campaigns attributed to advanced persistent threat (APT) activity fell from 16.6% to 9.1%.

Threat actor attribution became more fragmented: the top five actors accounted for 12.5% of references, down from 15.5%. UNC5267 took the top spot, while MuddyWater, Mustang Panda, and APT28 left the top 10 and TeamPCP and UNC6671 entered it. Among malware, Vidar and Atomic MacOS Stealer rose to the top, and LummaC2 and Rhadamanthys dropped out of the top 10.

Tactically, PowerShell remains the most referenced dual-use tool, though its share fell from 5.7% to 4.0% as actors diversified into python.exe, Node.js, and msiexec. The fastest-growing techniques point to credential and data theft over command and control (C2) hidden in trusted services: Credentials In Files (T1552.001), Dead Drop Resolver (T1102.001), Symmetric Cryptography (T1573.001), and Credentials from Web Browsers (T1555.003). Dead Drop Resolver's share more than tripled, as actors staged C2 details on platforms such as GitHub, Telegram, and public blockchains.

Outlook for CISOs

Based on the identity-focused, supply chain, and AI-enabled attacks observed between April and September 2026, we recommend focusing on the following priorities:

• Treat Identity as the Primary Perimeter: Restrict or block the OAuth device code flow where it isn't required, enforce phishing-resistant MFA, and verify help desk and IT support requests through out-of-band channels to counter voice phishing.
• Secure the Software Supply Chain End to End: Pin and verify dependencies, rotate CI/CD secrets regularly, and restrict publishing tokens so a single compromised package can't propagate across your ecosystem.
• Govern AI Tools and Agents: Inventory the AI assistants, agent skills, and MCP servers in use, source them only from vetted repositories, and monitor agent activity for prompt injection and abuse.
• Harden User Execution on Every Platform: Extend ClickFix defenses to macOS, restrict script execution from the Run dialog and Terminal, and train users to recognize copy-and-paste lures.
• Control Egress to Trusted Services: Monitor and restrict traffic to Telegram, GitHub, paste sites, and blockchain endpoints that attackers use for C2 and dead drop resolution.
• Accelerate Edge Patching: Keep treating VPNs, firewalls, and other public-facing infrastructure as top-priority assets with rapid patching and continuous monitoring.

Application: How to use this information

Any industry-leading assessment team and process must understand, acknowledge, and, where possible, mitigate the effects of bias—the natural, embedded, or invisible inclination to accept, reject, or manipulate facts and their meaning. The same precept holds true for consumers of the content.

Unlike a highly structured, control-based mathematical test or experiment, this report is inherently a convenience sample—a non-probability study type often used in medical, healthcare, psychology, and sociology testing that uses available, accessible data.

• In short, our findings here are based on what we can observe and, pointedly, do not include evidence of threats, attacks, or tactics that evaded detection, reporting, and data capture.
• In the absence of “complete” information or “perfect” visibility, this is the type of study best suited to this report’s objective: to identify known sources of critical data on cybersecurity threats and develop rational, expert, and ethical interpretations of this data that inform and enable best practices in cyber defense.