Cyber threat actors use AI to accelerate extortion and exploitation
Target Trend
Summary
Hide ▲
Show ▼
Cyber threat actors are shifting to routine operational use of AI, making extortion, reconnaissance, phishing, and exploit timing faster and lower-friction across the criminal ecosystem. The trend matters because attackers can begin scanning for newly announced CVEs within 15 minutes and, in some cases, cut network infiltration and data-exfiltration timelines from three to four weeks to under 25 minutes. AI is also helping low-skilled operators sound more professional, which lowers the barrier to entry for cybercrime and compresses defender response windows.
Related Happenings
Google GTIG analysis of adversary AI use for exploit development and attack orchestration
Technical Analysis
First: 11.05.2026 16:00
Last: 11.05.2026 16:00
Sources 1
About this happening:
**Google Threat Intelligence Group** published findings showing **adversaries using AI** for **exploit development** and **attack orchestration**, signaling that model-assisted tr...
Google GTIG analysis of adversary AI use for exploit development and attack orchestration
Technical AnalysisAbout this happening: **Google Threat Intelligence Group** published findings showing **adversaries using AI** for **exploit development** and **attack orchestration**, signaling that model-assisted tr...
Prominent cybercrime threat actors AI-assisted zero-day exploitation campaign
Campaign
First: 11.05.2026 16:00
Last: 11.05.2026 16:00
Sources 1
About this happening:
An **AI-assisted zero-day exploitation campaign** was planned by **prominent cybercrime threat actors**, but the effort was **disrupted before deployment** and did not reach its i...
Prominent cybercrime threat actors AI-assisted zero-day exploitation campaign
CampaignAbout this happening: An **AI-assisted zero-day exploitation campaign** was planned by **prominent cybercrime threat actors**, but the effort was **disrupted before deployment** and did not reach its i...
AI-generated code is driving a rising CVE trend in March 2026
Target Trend
First: 26.03.2026 18:40
Last: 26.03.2026 18:40
Sources 1
About this happening:
**AI-generated code** is driving a rising **CVE** trend, with **35 disclosures in March 2026** showing a material increase in flaws across **public advisories and open-source proj...
AI-generated code is driving a rising CVE trend in March 2026
Target TrendAbout this happening: **AI-generated code** is driving a rising **CVE** trend, with **35 disclosures in March 2026** showing a material increase in flaws across **public advisories and open-source proj...
Initial-access handoff time drops to 22 seconds across Mandiant investigations
Target Trend
First: 23.03.2026 17:00
Last: 23.03.2026 17:00
Sources 1
About this happening:
Across **Mandiant investigations**, the time from **initial access** to handoff to a **secondary threat group** has collapsed to **22 seconds**, sharply reducing defenders’ window...
Initial-access handoff time drops to 22 seconds across Mandiant investigations
Target TrendAbout this happening: Across **Mandiant investigations**, the time from **initial access** to handoff to a **secondary threat group** has collapsed to **22 seconds**, sharply reducing defenders’ window...
LayerX font-rendering PoC exposes a browser-rendering gap in AI assistant analysis
Technical Analysis
First: 17.03.2026 15:59
Last: 17.03.2026 15:59
Sources 1
About this happening:
A **LayerX** proof-of-concept showed that a **font-rendering attack** can hide malicious webpage commands from AI assistants, creating a risk of **unsafe guidance** when the brows...
LayerX font-rendering PoC exposes a browser-rendering gap in AI assistant analysis
Technical AnalysisAbout this happening: A **LayerX** proof-of-concept showed that a **font-rendering attack** can hide malicious webpage commands from AI assistants, creating a risk of **unsafe guidance** when the brows...
Timeline
-
17.02.2026 15:45 2 articles · 3mo ago
Unit 42 report on AI-assisted extortion and cybercrime acceleration
Initial DisclosureUnit 42 described low-skilled cybercriminals using LLM-powered AI assistants to automate extortion scripts and pressure tactics, a method the researchers dubbed "vibe extortion". The report said threat actors had moved in 2025 from experimentation to routine operational use, including scanning newly announced CVEs within 15 minutes, parallelizing reconnaissance and initial access attempts, and abusing enterprise AI platforms such as Google Vertex AI, while recommending automated patching, AI-driven response, behavioral email security, and out-of-band verification for sensitive requests.
Show sources
- Low-Skilled Cybercriminals Use AI to Perform "Vibe Extortion" Attacks — www.infosecurity-magazine.com — 17.02.2026 15:45
- Low-Skilled Cybercriminals Use AI to Perform "Vibe Extortion" Attacks — www.infosecurity-magazine.com — 17.02.2026 15:45