More than 730 cyber breaches affected over 270 million Americans last year, costing an average of $10 million per breach.
The post Senate Passes Bipartisan Bill to Strengthen Healthcare Cybersecurity appeared first on SecurityWeek.
Known as Rey, the suspect is reportedly helping the FBI identify and locate other members of the extortion group.
The post Alleged ShinyHunters Leader Arrested in Jordan appeared first on SecurityWeek.
Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched.
The post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first on SecurityWeek.
Table Of ContentsVulnerability and exposure management (VM) teams need critical metadata and context that clearly show which issues pose an immediate risk to their organization. While traditional VM frameworks tell defenders how severe a vulnerability may be, they do not provide visibility into how likely threat actors are to exploit it. This leaves security teams overwhelmed in patch backlogs without a clear strategy for prioritization.
Nowhere is this prioritization gap more dangerous than with ransomware. Ransomware-as-a-Service (RaaS) groups no longer choose targets at random. They look for specific technical conditions that make vulnerability exploitation easy, fast, and repeatable. With RaaS attacks rising by 45% period-over-period in H1 2026, organizations need a way to identify the specific traits that make a vulnerability attractive to ransomware operators before an attack occurs.
Flashpoint built the Ransomware Risk score into Flashpoint Vulnerability Intelligence to solve exactly this problem. Since 2022, it has rated newly discovered vulnerabilities based on how closely they resemble those known to be used in ransomware attacks. With the grant of the U.S. Patent No. 12,705,360 on August 11, 2026, the methodology behind the score is now formally patented. This milestone formalizes Flashpoint’s ability to cut through the noise with a proven, threat-informed signal that gives defenders the clarity they need to act on Day Zero.
“As vulnerability disclosures surge, prioritization is more important than ever for security teams. A severity score alone can’t tell you which vulnerabilities pose the greatest real-world risk of exploitation by ransomware actors.
Our patented Ransomware Risk model applies years of threat intelligence to that problem, giving customers an earlier signal and helping them prioritize based on how attackers actually operate.”
josh lefkowitz, co-founder and ceo at flashpoint
The patented system evaluates newly disclosed vulnerabilities against the patterns shared by vulnerabilities ransomware groups have exploited. Rather than trying to predict what threat actors will do next, the model learns what past ransomware-exploited vulnerabilities have in common and compares each new flaw against those patterns.
Every vulnerability ingested into Flashpoint Vulnerability Intelligence is profiled against more than 60 distinct technical factors. This “fingerprinting” links the vulnerability to key inputs including whether the flaw is remotely exploitable without authentication, whether it affects SCADA or Operational Technology (OT) systems, and its potential impact on data availability, which is central to extortion schemes.
The model turns each multi-factor fingerprint into a set of values that place it as a single point on a map, so vulnerabilities with similar profiles land close together.
Flashpoint overlays historical threat data onto the map to establish neighborhoods where vulnerabilities previously exploited in real-world ransomware attacks aggregate.
When a new vulnerability is ingested, its coordinates are checked against these neighborhoods. The scoring system calculates its spatial proximity to known ransomware vectors and assigns a clear rating: Low, Medium, High, or Critical.
This four-step method, developed by Flashpoint’s Ben Haynes and Jacob Kouns, is the basis of U.S. Patent No. 12,705,360.
By translating complex structural attributes into a single risk score, the patented model delivers four key operational advantages:
Flashpoint’s Ransomware Risk model is built to enhance, not replace the vulnerability management frameworks organizations already rely on. In fact, it provides even greater value for security teams as our Ransomware Risk model provides clarity for every vulnerability detailed by Flashpoint Vulnerability Intelligence, including over 105,000 issues missed by CVE and NVD.
Within Flashpoint Ignite, security teams have a complete view of vulnerability risk, seeing the score alongside CVSS (v3 and v4), EPSS, Social Risk, and exploit maturity.
Vulnerability management requires more than cataloging. It demands threat-informed prioritization that aligns security operations with real-world business risk. Flashpoint’s patented Ransomware Risk model eliminates guesswork by surfacing the flaws that match the profile of known ransomware targets, allowing security teams to patch what matters most, first.
By combining proprietary knowledge of vulnerability architecture and ransomware attacks, Flashpoint bridges the gap between theoretical and active exposure. Request a demo today to see how our Ransomware Risk model provides the definitive signal needed to stay ahead of extortion groups.
What is the Ransomware Risk score?
The Ransomware Risk score is a rating in Flashpoint Vulnerability Intelligence that shows how closely a vulnerability resembles those known to be used in ransomware attacks. Each vulnerability is rated Low, Medium, High, or Critical, so security teams can see which ones to patch first to reduce their ransomware exposure.
How is Ransomware Risk different from CVSS and EPSS?
CVSS measures how severe a vulnerability could be, and EPSS estimates how likely it is to be exploited in general. Ransomware Risk adds a ransomware-specific signal that works alongside both, showing how closely a vulnerability matches those ransomware groups have used. In Flashpoint Ignite, all three scores appear together.
What does Flashpoint’s ransomware patent cover?
U.S. Patent No. 12,705,360, granted August 11, 2026, covers Flashpoint’s method for rating how likely a vulnerability is to be used in a ransomware event. Each vulnerability is profiled on more than 60 factors, compared with vulnerabilities used in past ransomware attacks, and rated by similarity. The patent formalizes the model behind the Ransomware Risk score, live since 2022.
How often are Ransomware Risk scores updated?
Ransomware Risk scores update in near real time, so new vulnerabilities are rated as soon as they’re disclosed. The model also keeps adjusting as new vulnerabilities join the body it compares against, so ratings reflect the ransomware landscape as it stands today.
The post Ransomware Risk Model: Flashpoint’s Patented Scoring Method to Inform Vulnerability Prioritization appeared first on Flashpoint.
In this post, Flashpoint analysts examine Process Parameter Poisoning—a novel EDR evasion technique we validated in Rust—and detail how abusing undocumented process parameters allows attackers to inject code and bypass standard security products.
Table Of ContentsModern Endpoint Detection and Response (EDR) platforms have made traditional malware injection techniques significantly harder to execute. In most cases, if a threat actor attempts to write malicious code into a process, an alert will fire. However, that sense of security is being actively challenged as cybercriminals and red teams find new ways to blend malicious payloads into standard operating system routines.
Flashpoint’s Intelligence team built and tested a proof-of-concept for a newly disclosed technique known as Process Parameter Poisoning. By compiling a custom payload and layering evasion mechanics, our analysts demonstrated how easily traditional API hooks can be rendered blind in a laboratory environment—achieving zero alerts across tested EDR/XDR controls.
Process Parameter Poisoning is a novel endpoint detection and response (EDR) evasion technique that combines process parameter spoofing and thread execution hijacking to inject code into foreign processes without triggering standard security detection mechanisms.
Discovered by researchers Max Hirschberger and Ogulcan Ugur, Process Parameter Poisoning is designed to inject code in foreign processes without relying on the conventional memory-manipulation workflows that modern security tooling monitors.
To execute process injection, historically security tools and threat actors alike have focused on a small set of well-known Windows application programming interfaces (APIs). Process Parameter Poisoning shifts away from these heavily watched routines entirely. Instead of calling memory-accessing APIs to allocate and write into a target process, the technique hides the malicious payload directly inside standard process initialization structures during the initial creation of a process. The result is a fundamental shift in defense evasion that effectively blinds traditional, API-hooking EDR agents during the initial stages of code execution.
Process Parameter Poisoning allows attackers to bypass suspicious memory-accessing Windows APIs, such as VirtualAllocEx(), WriteProcessMemory(), and MapViewOfFile2(). Security products heavily monitor these specific APIs due to their high rate of abuse in traditional process injection techniques. However, by avoiding these calls, an attacker effectively bypasses the initial primary triggers used by endpoint agents to flag malicious cross-process memory activity.
When using the Windows application programming interface (API), CreateProcessA/W(), the developer can specify parameters such as the command-line to be executed by the new process, environment variables for the new process, current working directory for the process, window title if it is a console application, create a hidden window, create the process in a suspended state, etc. Many of these parameters are passed into CreateProcessA/W() via the STARTUPINFOA/W structure.
Some entries are undocumented and labeled “reserved” by Microsoft. The discovering researchers found that data stored in STARTUPINFO->lpReserved ends up in the Process Environment Block once the new process is initialized in an entry called “ShellInfo.” Below is an example of placing data into the STARTUPINFOW->lpReserved entry in a test application and the data stored in ShellInfo while debugging the newly created process.
Flashpoint analysts created a proof-of-concept (POC) in Rust to test this technique based on the POC C++ source code provided by the researchers:
Flashpoint confirmed that after changing the memory to have executable permissions, the threat actors can perform thread hijacking by using GetThreadContext() to acquire information about the current running thread, change the instruction pointer to point to the ShellInfo.Buffer address, and then SetThreadContext() to apply the changes and execute the shellcode.
Flashpoint analysts further confirm that this technique also works with the WindowTitle entry, CommandLine entry using the same series of steps.
The technique also works with the Environment entry but requires additional steps. Environment blocks require a variable name and the variable data separated by an “=.” Environment blocks can contain multiple variable entries in which each entry is ended with a null terminator. Two null terminators are necessary to denote the end of the environment block. This means the payload needs to be embedded in a longer string with a “{NAME} = {VALUE}” format.
Flashpoint analysts note that four null terminators were appended to the shellcode bytes to denote the end of an environment block in Unicode. The resulting payload buffer is then passed into the lpEnvironment variable of CreateProcessW() along with the CREATE_UNICODE_ENVIRONMENT creation flag.
The rest of the process remains the same as reading the PEB and RTL_USER_PROCESS_PARAMETERS structure. The Environment entry is read, but at the offset of the embedded shellcode within the poisoned environment block string. Because four bytes were added to the beginning of the shellcode to make the Unicode environment block, execution needs to begin after four bytes from the beginning of the buffer to begin executing at the shellcode.
Flashpoint notes that the shellcode requires no NULL bytes, and, if using the PAGE_EXECUTE_READ flag, it cannot overwrite itself. This means automated shellcode generators such as MSFVenom might not work either because they contain NULL bytes or use encoders that perform memory writes during execution. Flashpoint analysts wrote custom shellcode to further test this technique. The shellcode downloads and executes an additional payload. The combination of this technique, custom shellcode, and the use of Rust as the programming language proved successful in minimizing initial static detections by security software.
Flashpoint tested this technique with a commonly-used open source EDR platform. The EDR platform itself failed to produce any alerts from executing the malicious binary. However, the XDR component blocked on the initial creation of a new process and COM interactions by the second stage payload.
Flashpoint analysts then combined this technique with the DLL unhooking technique and applied the non-Microsoft block DLL policy during the creation of the sacrificial process. Analysts observed no blocks from the XDR during execution and observed no alerts on the platform.
| Tactic | Technique ID | Technique Name |
| Stealth | T1055 | Process Injection |
| Stealth | T1055.003 | Process Injection: Thread Execution Hijacking |
| Stealth | T1564.010 | Hide Artifacts: Process Argument Spoofing |
Security teams can leverage several detection strategies to identify Process Parameter Poisoning, though each approach carries distinct limitations:
Process Parameter Poisoning demonstrates another advancement in stealthy process injection and the constantly evolving research into evading security products. By using the previously unknown purpose of the lpReserved field within the STARTUPINFOW structure to house shellcode, this technique bypasses standard security product triggers associated with common memory-allocation APIs. While this proof-of-concept was proven successful in lab testing, the technique has multiple opportunities for detection and will most likely require a combination of additional evasion techniques to achieve a higher success rate.
As threat actors continue to refine technique-stacking and exploit overlooked Windows internals, relying on traditional API hooks is no longer enough to protect your enterprise. Staying ahead of modern evasion mechanics requires proactive intelligence and deep visibility into emerging adversary TTPs.
Request a demo today to see how best-in-class threat intelligence can help security teams detect, prepare for, and neutralize advanced defense evasion techniques before they impact your network.
The post Process Parameter Poisoning: Inside a Novel EDR Evasion Technique appeared first on Flashpoint.
Threat actors are no longer just using automation to execute tasks, they are leveraging prepackaged, safeguard-free AI, weaponizing stolen session data, and directly targeting defenders’ security stacks.
Table Of ContentsIn our latest webinar, Flashpoint Vice President of Intelligence, Ian Gray, briefed security leaders on the evolving threat environment, providing critical insights from the Flashpoint Global Threat Intelligence Report (GTIR): 2026 Midyear Edition.
The threat landscape has developed at a striking pace with Flashpoint tracking over 22 million illicit AI discussions, 7.4 million compromised hosts yielding 1.7 billion stolen credentials, and over 21,600 disclosed vulnerabilities in just six months. Beyond these staggering numbers, the on-demand session detailed something even more alarming: a fundamental shift in adversary operational tradecraft.
Here are the five critical shifts every cyber threat intelligence (CTI), Vulnerability Management, and SOC team needs to know.
The public discussion surrounding criminal artificial intelligence (AI) has reached a critical inflection point. Early in the AI boom, Flashpoint observed threat actors collaboratively experiment across underground forums, jailbreaking commercial frontier models or advertising surface-level tools like WormGPT and DarkGPT.
Today, adversaries are shifting from public forums to running fine-tuned, open-source models locally on private servers, which greatly hampers traditional signature-based detection. Flashpoint analysts are now seeing attackers generate unique, highly tailored malware variants, flawless phishing lures, and custom exploit scripts at extremely low costs—completely offline and shielded from public monitoring.
“A few months ago, a lot of this was collaborative… public outsourcing. Now what we’re seeing is scarier: pre-packaged cybercrime models run locally on private infrastructure. Malicious code, exploit scripts, and targeted phishing are all being generated inside closed environments.”
Ian Gray, VP of Intelligence, Flashpoint
Another eye-opening tactical insight shared during the session was how threat actors are repurposing defender infrastructure for automated initial access and extortion. In the webinar, we pointed to recent campaigns where adversaries specifically targeted misconfigurations and zero-day vulnerabilities inside open-source vulnerability scanners, secrets-detection tools, Kubernetes clusters, and Infrastructure-as-Code(IaC) environments.
What this means for defenders is that the attack surface is no longer bounded by traditional enterprise network boundaries: it extends directly into CI/CD pipelines, security orchestration tooling, and third-party SaaS integrations. Security teams are finding themselves in a race against attackers who use automated scanning scripts to weaponize vulnerabilities in the security tools themselves.
Flashpoint tracked 7.4 million hosts compromised by infostealers in H1 2026—a 27% increase period-over-period—harvesting 1.7 billion credentials and identity information.
While the top infostealer strains remain familiar, law enforcement operations have created vacuums that competitors rapidly fill.
Threat actors are leveraging drive-by downloads, watering holes, and pirated software packages to plant stealers. Once a machine is compromised, the logs capture corporate SSO credentials, active browser cookies, VPN keys, and SaaS session tokens. This enables adversaries to simply log in without having to leverage complex technical exploits.
The Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD) have failed to keep pace with the velocity of AI-assisted vulnerability discovery. As such, vulnerability management teams are facing significant operational delays.
| Metric | Flashpoint GTIR Midyear H1 2026 Data | Operational Impact |
| Total Disclosures | 21,667 | Remediation volume exceeds defender bandwidth. |
| Exploit Availability | 19% (4,015 CVEs) | Functional code is ready before patches are deployed. |
| Public Catalog Lag | Growing Backlog (NVD/KEV) | Delay in official scoring leaves teams blind to active risk. |
Therefore, waiting for NVD enrichment before prioritizing a patch is a dangerous strategy. To compensate, security teams require Vulnerability Intelligence (VI) that provides primary-source confirmation of weaponization, exploit availability, and actionable mitigation guidance long before public databases update.
Ransomware-as-a-Service (RaaS) activity surged by 45% period-over-period, reaching 6,256 verified victim postings on data leak sites. However, total on-chain payout revenue dropped by 8% to $820 million, with victim pay-rates hitting a record low of 28%.
Faced with declining payouts and resilient enterprise backups, extortion syndicates are adapting. Rather than relying exclusively on technical file-encrypting malware, groups are executing pure data extortion campaigns—frequently targeting cloud platforms or extracting data through third-party vendor access.
Defending against machine-speed attacks requires moving beyond reactive, post-incident telemetry. Flashpoint arms security, CTI, and vulnerability management teams with the primary-source intelligence required to preempt adversary operations:
Request a demo, or watch the full on-demand webinar to explore the data shaping today’s risk landscape.
The post Cybercrime at Machine Speed: Key Takeaways from Flashpoint’s 2026 Midyear Threat Intelligence Briefing appeared first on Flashpoint.
In this post we examine how modern hacktivism has evolved into a tool of global hybrid warfare, analyzing crowdsourced attack tactics, media-driven propaganda, and real-world impacts across Ukraine, the Middle East, European Union, and NATO nations.
Table Of ContentsHacktivism used to be perceived as digital graffiti, with lone-wolf threat actors defacing government websites or temporarily crashing banking portals to make a political point. However, Flashpoint is tracking a fundamental shift in how these groups operate.
Modern hacktivism is evolving into a disciplined component of global hybrid warfare, capable of bridging digital disruptions with tangible real-world impact. Today, these operations blur the line between volunteer activism and coordinated state interest, leveraging crowdsourced infrastructure to disrupt critical utilities, manipulate media narratives, and target public infrastructure on a global scale. Unpacking these modern hacktivist collectives reveals what their tactics look like in practice and their far-reaching consequences across dozens of nations.
Hacktivism is the use of cyberattacks to promote or advance a particular political or social cause, leveraging a wide range of tactics such as website defacement, distributed denial-of-service (DDoS) attacks, and data breaches. Modern hacktivist collectives serve as the loud, high-visibility arm of cyber conflict—frequently aligning with state geopolitical interests, as seen most prominently in recent pro-Russian operations and Iranian-aligned cyber campaigns.
These pro-Russian hacktivist groups, such as NoName057 and Killnet, alongside pro-Iranian collectives and proxy ecosystems like Handala Hack, often react to the news cycle and target countries designated by state media or ideological narratives as enemies. As such, modern hacktivist campaigns are opportunistic and tied to global events—from the escalation in the Middle East following military operations like Operation Epic Fury, to the Milan-Cortina Winter Olympics and new aid packages to Ukraine. These groups’ justification narratives typically mirror state messaging.
In tracking modern hacktivist groups, Flashpoint analysts identified a new method these groups are utilizing to convert ordinary devices into tools for hybrid warfare—the gamification of cyberattacks. Flashpoint has observed groups like NoName057 turning DDoS attacks into community-based “patriotic online games,” such as their “DDoSia Project,” with participants earning military-style ranks and cryptocurrency rewards for overloading the websites of government institutions, banks, and various infrastructure across various countries.
This model has enabled the scaling of operations by utilizing a large, low-skilled participant base rather than having to rely on sophisticated technical tradecraft. The model’s decentralized structure and ideological appeal continue to pose a significant challenge for international law enforcement.
Beyond technical disruptions, publicity is the primary currency of modern hacktivism. Hacktivist groups demonstrate a consistent pattern of media-seeking behavior and self-promotion, likely intended to amplify their perceived impact and reinforce notoriety within the broader cyber threat landscape. Many of these groups repeatedly repost media coverage and news articles referencing themselves.
This serves as a curated self-promotion mechanism, allowing the group to selectively showcase external validation of its operations, including coverage from mainstream and security-focused outlets, to its followers. This behavior aligns with a broader trend observed with especially pro-Russian hacktivist collectives, in which media visibility is treated as a measure of operational success independent of verified technical impact. It also serves as a deliberate tactic for engagement and recruitment that reinforces “patriotic” branding and sustains participant morale and visibility.
In some cases, the digital targeting of hacktivist collectives is more aligned with kinetic objectives, rather than public perception or propaganda initiatives. This is especially true for Iranian-aligned hacktivists and proxy groups who are more deeply intertwined with military operations in the Middle East. These groups have expanded their operations from website disruptions into claims of large-scale data wipers, extortion, and cyberattacks targeting key infrastructure across the Gulf.
Major geopolitical flashpoints in the Middle East have triggered waves of hacktivist activity that has spread across North America, with threat actors targeting supply chains, financial infrastructure, and operational technology and control systems.
Simultaneously, pro-Russian hacktivist groups, particularly NoName057, have been extremely prolific within the last year—carrying out two major illicit campaigns heavily targeting Ukraine, which then spilled over to more than 30 nations globally. The following breakdown contains statistics and targeting dynamics of pro-Russian hacktivist groups observed between July 2025 and 2026:
Ukraine has been the primary target for pro-Russian hacktivist groups who seek to damage Ukrainian infrastructure and morale. Anti-Ukrainian content is constantly distributed through dedicated per-language channels, making it the most linguistically developed target spanning six languages. Involved channels each post near-identical translated content within minutes to hours of the Russian original, down to the same image file with identical SHA1 hashes, which suggests a sustained propaganda distribution operation.
This has resulted in alleged data breaches impacting Ukrainian General Staff, military enlistment offices, medical, and morgue databases to push a casualty-count narrative. It also has resulted in the defacement or disruption of websites of regional capitals and administrative centers, energy plants, water and power-adjacent infrastructure, and many more.
However, Ukraine is not the sole casualty of modern hacktivism. Recent pro-Russian hacktivist campaigns have spread to other EU nations and NATO members. Germany, the United Kingdom, and Spain have been observed to be priority targets, with threat actors targeting public transportation, federal and security agencies, municipal government and utilities, financial markets, and other infrastructure. In some cases, hacktivist campaigns manifest in the real-world, with physical sticker drives on municipal streets, alongside doxxing operations releasing alleged personal data and automated scans hijacking exposed CCTV camera systems across Europe.
As hacktivist operations continue to blur the boundary between digital disruption and real-world interference, organizations can no longer view DDoS attacks or low-level intrusions as simple background noise. Protecting critical assets requires proactive visibility into threat actor networks, early detection of targeting narratives, and primary source threat intelligence.
Request a demo today to see how Flashpoint provides actionable intelligence to help security teams, government agencies, and infrastructure providers identify, monitor, and mitigate emerging hacktivist campaigns before they impact operations.
The post The Evolution of Hacktivism in Hybrid Warfare: Modern Tactics and Real-World Impact appeared first on Flashpoint.
Flashpoint’s monthly analysis of insider threat recruitment, illicit access advertising, and threat actor activity targeting enterprise environments.
Table Of ContentsUnknowingly, a member of key personnel is living two separate lives. On the clock, they are a highly-trusted systems administrator, but in their personal time, they moonlight on the deep and dark web, advertising their trust and access to the highest bidder. One day, they get a simple offer: $15,000 in the crypto of their choice to approve a single push notification at 2 AM. They accept. By morning, the attacker walks away with active domain admin credentials without the need for malware or cracking firewalls.
This is just one example of how insider threats lead to modern enterprise breaches. As perimeter security, EDR coverage, and other security tools mature, threat actors continue to target the human element, seeking employees and contractors willing to provide access to corporate systems or facilitate fraudulent activity.
In a threat landscape where identity is becoming the primary attack surface, monitoring illicit marketplaces and recruitment efforts is critical. This new monthly report leverages Flashpoint’s Primary Source Collection (PSC) to analyze insider threat tactics, tracking active recruitment and advertising on dark web forums and encrypted networks.
In September 2026, Flashpoint analysts identified a total of 9,787 insider-related posts across 1,216 channels and 1,778 authors. While the volume of observed activity decreased, threat actors continued to actively seek and advertise insider access, particularly within industries where legitimate employee privileges can be exploited to facilitate fraud. These communications included threat actors attempting to recruit insiders at target organizations, insiders advertising their services, and general discussions involving insider-related threat activity.
Of these communications, Flashpoint observed 857 unique posts between September 1 and September 30, 2026.
The majority of these posts appeared in mid-tier English-language Telegram channels, where threat actors sought or advertised insider access to organizations across several industries. Much of the observed activity focused on recruiting insiders to facilitate fraud operations.
Retail, telecommunications, and financial services remained prominent targets for insider threat activity in September 2026. However, a significant portion of the observed activity could not be attributed to a specific industry.
Flashpoint found that 45.7% of unique insider posts fell into the “Unknown” category, meaning analysts could not determine the targeted organization or industry. Among posts with an identifiable industry, retail accounted for the largest share, followed by telecommunications, financial services, and technology.
Together, these four industries accounted for 419 unique posts, or nearly 49% of all unique insider-related activity observed during the month.
The concentration of activity in retail, telecommunications, and financial services reflects continued threat actor interest in insiders who may be positioned to facilitate fraud, provide access to customer accounts, or exploit legitimate organizational privileges.
The following table shows a breakdown of unique insider posts by industry in September 2026:
| Industry | Posts |
| Other | 392 |
| Retail | 135 |
| Telecom | 116 |
| Financial | 85 |
| Technology | 83 |
| Public Sector | 41 |
| Healthcare | 3 |
| Media | 2 |
| Total | 857 |
Active insider threats generally involve two types of activity: an insider is recruited by a malicious outside party, or an insider advertises their access and services to interested threat actors. These arrangements can enable adversaries to exfiltrate sensitive data, install malware, compromise accounts, or carry out fraudulent activities such as SIM swaps.
In September 2026, Flashpoint analysts identified 15 notable insider recruitment and advertising posts across underground communities and chat forums. Of these, nine involved threat actors attempting to recruit insiders, while six involved actors advertising insider services.
Telecommunications accounted for the largest number of notable posts, with five instances of recruitment or advertising. Retail and technology followed with three each, while financial services and the public sector accounted for two each.
These examples illustrate how threat actors continue to seek access across industries, with particular interest in employees and contractors who can facilitate fraud or provide privileged access to organizational systems.
Flashpoint also observed numerous insider solicitations repeated across multiple discussion threads, often with limited details about the access or services being offered. Analysts could not independently verify the legitimacy of the recruitment and advertising claims.
Insider threats are inherently difficult to detect using internal security controls alone because the malicious activity relies on valid credentials and legitimate access privileges. Relying solely on internal logs means security teams often only detect an insider threat after data exfiltration or system sabotage has already occurred.
Flashpoint protects organizations against insider threats through our Primary Source Collection (PSC) and specialized intelligence platforms:
To learn more about how Flashpoint can help protect your enterprise from insider risk and monitor illicit underground communities, Request a Demo Today.
What is the Flashpoint Insider Threat Report?
The Flashpoint Insider Threat Report is a monthly intelligence brief that analyzes trends, volume, targeted industries, and tactics surrounding insider threat recruitment and illicit access advertising on the deep web, dark web, and encrypted chat channels.
How does Flashpoint collect insider threat data?
Flashpoint collects data using its Primary Source Collection (PSC) engine, which actively monitors thousands of dark web forums, illicit marketplaces, and underground chat networks where threat actors and malicious insiders communicate.
What is the difference between insider recruitment and insider advertising?
Insider recruitment occurs when an external cybercriminal attempts to entice a corporate employee into assisting with a cyberattack. Insider advertising occurs when an employee or contractor proactively lists their legitimate access or services for sale on illicit marketplaces.
The post Insider Threat Report: Dark Web Recruitment & Access Trends appeared first on Flashpoint.
In this post, we preview the critical findings of Flashpoint’s Global Threat Intelligence Report: 2026 Midyear Edition.
Table Of ContentsIn the first half of 2026, the global threat landscape reached a clear operational inflection point: threat operations have fundamentally transitioned from human-led campaigns to machine-speed, AI-driven exploitation. As threat actors gain commoditized access to open-source AI technologies and actively deploy automated, safeguard-free tooling locally on private infrastructure, organizations face an accelerating hybrid risk environment.
The Flashpoint Global Threat Intelligence Report: 2026 Midyear Edition anchors security leaders—from threat intelligence, vulnerability management, to executive leadership—in the data required to navigate this evolving threat landscape. Covering the period from January 1 to June 30, 2026, the report delivers timely insights backed by Flashpoint’s proprietary primary-source collection from over 3.9 petabytes of continuously monitored illicit sources.
Our midyear findings reveal several key metrics that highlight the speed and scale of the H1 2026 threat landscape:
Download the Flashpoint Global Threat Intelligence Report: 2026 Midyear Edition to gain:
“AI is compressing the time between opportunity and exploitation. Capabilities that once took significant expertise, coordination, and time to develop are becoming faster to build, easier to scale, and harder to detect. Security teams are facing an adversary ecosystem that can use AI to iterate at unprecedented speed — the only way to keep pace is with primary-source intelligence that surfaces adversary behavior before attacks unfold.”
Josh Lefkowitz, Flashpoint Co-Founder & CEO
During the first half of 2026, Flashpoint captured over 22M illicit posts discussing or advertising AI for criminal-related activities. By stripping ethical safeguards, custom malicious LLMs allow unsophisticated threat actors to automate complex phases of the attack lifecycle, including target profiling, malware evasion script creation, and zero-day exploit generation.
Infostealer malware harvested 1.7 billion credentials across 7.4 million compromised systems in H1 2026 alone, turning digital identity into the main entry point for enterprise intrusions.
19% (4,015) of all H1 2026 vulnerability disclosures arrived with ready-made exploit code. Adversaries deploy automated replication scripts almost immediately upon disclosure, eliminating manual remediation windows.
Despite a 45% surge in victim volume (6,256 overall), total on-chain revenue fell by 8% to $820M. Improved enterprise backups and incident response have driven payout rates down to 28%, prompting syndicates to demand larger sums from paying victims.
The data shows that traditional enterprise security organizations are struggling to keep pace with modern threat cycles that are accelerated by illicit uses of AI. This continued convergence of AI engines and initial access vectors have further compressed attack timelines, making it nearly impossible for security teams to defend against them—especially if they are limited by traditional approaches to threat intelligence.
Equipping your team with primary-source threat intelligence is critical for protecting critical assets in 2026. Download the Flashpoint Global Threat Intelligence Report: 2026 Midyear Edition to gain the visibility and strategic clarity required to defend your organization.
The post Navigating AI-Driven Cyber Threats: Insights from Flashpoint’s 2026 GTIR Midyear Edition appeared first on Flashpoint.
The attacks targeted the US Department of Education and Library and Archives Canada, and researchers linked some agents to OpenAI.
The post AI Agents Aimed SQL Injection at US and Canadian Government Sites appeared first on SecurityWeek.
CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system.
The post Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action appeared first on SecurityWeek.
Rob Juncker is chief product and technology officer at Mimecast. Is he a hacker? “Unequivocally yes,” he says.
The post Hacker Conversations: Rob Juncker, a Knock at the Door and a Moral Compass appeared first on SecurityWeek.
According to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. Governments are also the most frequently targeted sectors for nation-state activity. They are attractive targets because they hold sensitive information, operate essential services, and sit at the center of networks of agencies, contractors, technology providers, and critical infrastructure operators.
Dwell time, the period between when an attacker gains access and when defenders detect and stop them, also increased this year across multiple sectors. While organizations responded faster once an intrusion was identified, detecting threats early remains a challenge. Attackers increasingly gain access through techniques that mimic legitimate activity, making malicious behavior harder to spot. For example, phishing accounted for 23% of observed intrusions in 2026, up from 7% in 2025, highlighting the continued importance of compromised identities as an entry point for broader attacks.
Taken together, the implication for governments is clear. Security in the AI era is no longer simply about preventing individual intrusions. It is about ensuring institutions can operate effectively in an environment where risks are interconnected, threats move faster, and attackers remain hidden longer. Public-private partnerships are also more important than ever for securing critical government infrastructure and developing the policies and regulations needed for emerging technologies.
In this year’s report, which examines cyber threat trends observed between July 2025 and June 2026, Terrell Cox, Microsoft’s Corporate Vice President & Deputy Chief Information Security Officer, and I explore how these dynamics are reshaping cyber risk. In a companion blog, Terrell takes a closer look at what these findings mean for CISOs and security professionals.
AI is compressing the window for action. Adversaries are moving faster. A vulnerability’s discovery in the wild to active weaponization can be well below 24 hours. While the number of publicly disclosed software vulnerabilities (commonly tracked as CVEs) is projected to reach a record 72,000 in 2026.
Governments best prepared for the future will be those that can rapidly gather and assess information, make decisions, coordinate across institutions and industries, and communicate effectively during a crisis. This requires clearly defined responsibilities and trusted relationships established before an incident occurs, enabling swift and coordinated action when it matters most.
AI is becoming part of the infrastructure that governments, businesses, and citizens rely on every day. As governments continue to adopt AI across public services and encourage its broader use, they should approach its security as a resilience challenge rather than a narrow technical issue.
AI systems depend on interconnected infrastructure, data, models, applications, suppliers, and governance processes. Governments should promote security across this ecosystem through secure-by-design practices, testing and evaluation, stronger supply chain protections, transparency, accountability, and international cooperation on AI risk.
The goal is not to create a separate AI security agenda. It is to integrate AI security into broader efforts to protect critical infrastructure and build national resilience.
Governments may not immediately know whether an intrusion is criminal, geopolitical, or something else. Cybercriminals and nation-state actors pursue different objectives, but increasingly rely on many of the same entry points, including compromised identities, exposed applications, social engineering, and legitimate administrative tools.
Microsoft found that 52.2% of intrusions involving valid accounts resulted in additional credential theft, highlighting how quickly attackers can expand beyond an initial foothold. A seemingly isolated compromise can evolve into ransomware, espionage, data theft, or disruption of essential services.
Governments should therefore assess incidents not only by how they begin, but by where they could lead. Response plans should account for the suppliers, partners, and service providers supporting critical functions. As attacks expand beyond their initial targets, they can also cross organizational, sectoral, and national boundaries, reinforcing the need for global collaboration.
A compromised account at one organization may provide early warning of a broader campaign. Signals that appear inconclusive in isolation can reveal coordinated activity when combined across organizations and jurisdictions. Modern cybercrime operates through interconnected networks of actors, services, and infrastructure that no single institution can fully see or disrupt on its own.
Information sharing must be timely, trusted, and two-way—also known as bidirectional. The goal is not simply for companies to report threats to government. Public agencies should also return actionable intelligence, guidance, and warnings that help organizations protect their networks, customers, and operations. Trusted channels can enable this exchange among government agencies, law enforcement, critical infrastructure operators, technology providers, and international partners while respecting legal and privacy requirements.
Policymakers can support this cooperation through protections for good-faith information sharing, common anonymization standards, and investment in shared threat intelligence and detection capabilities. Information sharing should also lead to action, including investigations, disruption efforts, and accountability for those responsible for serious cyber intrusions.
The organizations governments depend on to deliver public services, including transportation systems, communications infrastructure, schools, universities, and critical infrastructure operators, are increasingly targeted by cyber threats. Resilience therefore requires understanding not only government systems, but the broader ecosystem that supports them.
Planning documents alone are not enough. Governments should regularly conduct tabletop exercises bringing together policymakers, operational leaders, law enforcement, critical infrastructure operators, and private-sector partners to test how they would respond to incidents disrupting essential services. These exercises can expose gaps in decision-making, information sharing, public communications, and cross-sector coordination before a real-world crisis. Microsoft’s work through initiatives such as the Advancing Regional Cybersecurity (ARC) program, most recently in Kenya, illustrates how scenario-based exercises and cross-sector collaboration can help strengthen preparedness and response capabilities across the broader ecosystem.
Government leaders should also know which services are most critical, which identities, systems, suppliers, and infrastructure support them, and how incidents will be escalated. Shared-service approaches can help extend security and response capabilities to local governments and public institutions that cannot build them independently.
As cyber incidents cross organizational and national boundaries, resilience depends not only on technical preparedness, but on whether institutions can coordinate effectively under pressure.
In an era of AI-enabled and increasingly interconnected cyber threats, resilience is no longer simply about recovering from an attack. It is about preparing for a world in which cyber incidents move faster, spread further, and affect more organizations than ever before. Governments best prepared for the future will be those that can contain harm, adapt quickly, and continue delivering critical services when citizens need them the most.
The post Preparing governments for an era of interconnected cyber risk appeared first on Microsoft On the Issues.
Flashpoint was awarded U.S. Patent No. 12,705,360 for its Ransomware Risk model, which rates how closely new vulnerabilities match those used in ransomware attacks.
Table Of ContentsVulnerability and exposure management (VM) teams need critical metadata and context that clearly show which issues pose an immediate risk to their organization. While traditional VM frameworks tell defenders how severe a vulnerability may be, they do not provide visibility into how likely threat actors are to exploit it. This leaves security teams overwhelmed in patch backlogs without a clear strategy for prioritization.
Nowhere is this prioritization gap more dangerous than with ransomware. Ransomware-as-a-Service (RaaS) groups no longer choose targets at random. They look for specific technical conditions that make vulnerability exploitation easy, fast, and repeatable. With RaaS attacks rising by 45% period-over-period in H1 2026, organizations need a way to identify the specific traits that make a vulnerability attractive to ransomware operators before an attack occurs.
Flashpoint built the Ransomware Risk score into Flashpoint Vulnerability Intelligence to solve exactly this problem. Since 2022, it has rated newly discovered vulnerabilities based on how closely they resemble those known to be used in ransomware attacks. With the grant of the U.S. Patent No. 12,705,360 on August 11, 2026, the methodology behind the score is now formally patented. This milestone formalizes Flashpoint’s ability to cut through the noise with a proven, threat-informed signal that gives defenders the clarity they need to act on Day Zero.
“As vulnerability disclosures surge, prioritization is more important than ever for security teams. A severity score alone can’t tell you which vulnerabilities pose the greatest real-world risk of exploitation by ransomware actors.
Our patented Ransomware Risk model applies years of threat intelligence to that problem, giving customers an earlier signal and helping them prioritize based on how attackers actually operate.”
josh lefkowitz, co-founder and ceo at flashpoint
The patented system evaluates newly disclosed vulnerabilities against the patterns shared by vulnerabilities ransomware groups have exploited. Rather than trying to predict what threat actors will do next, the model learns what past ransomware-exploited vulnerabilities have in common and compares each new flaw against those patterns.
Every vulnerability ingested into Flashpoint Vulnerability Intelligence is profiled against more than 60 distinct technical factors. This “fingerprinting” links the vulnerability to key inputs including whether the flaw is remotely exploitable without authentication, whether it affects SCADA or Operational Technology (OT) systems, and its potential impact on data availability, which is central to extortion schemes.
The model turns each multi-factor fingerprint into a set of values that place it as a single point on a map, so vulnerabilities with similar profiles land close together.
Flashpoint overlays historical threat data onto the map to establish neighborhoods where vulnerabilities previously exploited in real-world ransomware attacks aggregate.
When a new vulnerability is ingested, its coordinates are checked against these neighborhoods. The scoring system calculates its spatial proximity to known ransomware vectors and assigns a clear rating: Low, Medium, High, or Critical.
This four-step method, developed by Flashpoint’s Ben Haynes and Jacob Kouns, is the basis of U.S. Patent No. 12,705,360.
By translating complex structural attributes into a single risk score, the patented model delivers four key operational advantages:
Flashpoint’s Ransomware Risk model is built to enhance, not replace the vulnerability management frameworks organizations already rely on. In fact, it provides even greater value for security teams as our Ransomware Risk model provides clarity for every vulnerability detailed by Flashpoint Vulnerability Intelligence, including over 105,000 issues missed by CVE and NVD.
Within Flashpoint Ignite, security teams have a complete view of vulnerability risk, seeing the score alongside CVSS (v3 and v4), EPSS, Social Risk, and exploit maturity.
Vulnerability management requires more than cataloging. It demands threat-informed prioritization that aligns security operations with real-world business risk. Flashpoint’s patented Ransomware Risk model eliminates guesswork by surfacing the flaws that match the profile of known ransomware targets, allowing security teams to patch what matters most, first.
By combining proprietary knowledge of vulnerability architecture and ransomware attacks, Flashpoint bridges the gap between theoretical and active exposure. Request a demo today to see how our Ransomware Risk model provides the definitive signal needed to stay ahead of extortion groups.
What is the Ransomware Risk score?
The Ransomware Risk score is a rating in Flashpoint Vulnerability Intelligence that shows how closely a vulnerability resembles those known to be used in ransomware attacks. Each vulnerability is rated Low, Medium, High, or Critical, so security teams can see which ones to patch first to reduce their ransomware exposure.
How is Ransomware Risk different from CVSS and EPSS?
CVSS measures how severe a vulnerability could be, and EPSS estimates how likely it is to be exploited in general. Ransomware Risk adds a ransomware-specific signal that works alongside both, showing how closely a vulnerability matches those ransomware groups have used. In Flashpoint Ignite, all three scores appear together.
What does Flashpoint’s ransomware patent cover?
U.S. Patent No. 12,705,360, granted August 11, 2026, covers Flashpoint’s method for rating how likely a vulnerability is to be used in a ransomware event. Each vulnerability is profiled on more than 60 factors, compared with vulnerabilities used in past ransomware attacks, and rated by similarity. The patent formalizes the model behind the Ransomware Risk score, live since 2022.
How often are Ransomware Risk scores updated?
Ransomware Risk scores update in near real time, so new vulnerabilities are rated as soon as they’re disclosed. The model also keeps adjusting as new vulnerabilities join the body it compares against, so ratings reflect the ransomware landscape as it stands today.
The post Ransomware Risk Model: Flashpoint’s Patented Scoring Method to Inform Vulnerability Prioritization appeared first on Flashpoint.
The accord opened the door to future regulation but focused on four voluntary steps for the companies to take.
The post Trump Says Top Tech Firms Have Signed Accord to ‘Self-Police’ AI Development appeared first on SecurityWeek.
The data breach affects the Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense.
The post Pentagon Personnel Agency Data Breach Impacts 3 Million People appeared first on SecurityWeek.
Apple released iOS and macOS updates to patch a zero-day vulnerability (CVE-2026-86950) reported by Meta’s product security team.
The post Apple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’ appeared first on SecurityWeek.
Microsoft has served the Middle East since it began operations in the region in 1991. Since then, we’ve steadily expanded our presence and investments, growing from a local technology provider into a long-term partner to governments, businesses, educational institutions, and civil society organizations. Today, Microsoft is reaffirming that commitment through a new framework focused initially on Kuwait, Qatar, Saudi Arabia, and the United Arab Emirates.
We are expanding our investments in the Middle East with confidence in the region’s future as it pursues one of the world’s most ambitious AI transformations. We will add to our local partnerships across the region. We will build on the work we have done to stand by these countries’ governments and people through a period of significant challenges. As we look to the future, we will invest further in technology, digital resilience, and the people across the region.
From now until 2030, we will pursue the following initiatives with our partners in the region:
We will expand cloud and AI infrastructure across the Middle East
Microsoft will continue to invest in cloud and AI infrastructure across the region, expanding capacity, launching new capabilities, and delivering long-term infrastructure commitments. We plan to invest more than $10 billion in capital and operating expenses between now and 2030 in the region.
We will deepen our partnerships through national AI champions
Microsoft will deepen strategic partnerships with governments and national AI champion organizations to translate AI ambition into economic growth, modern public services, and global competitiveness. This builds on work with organizations including HUMAIN, G42, QAI, and the Government of Kuwait, alongside digital-government initiatives such as TAMM in the UAE, SDAIA’s ALLaM in Saudi Arabia, TASMU in Qatar, and Microsoft 365 Copilot adoption across the Government of Kuwait.
These partnerships will support responsible AI adoption, sovereign-ready cloud services, Arabic and multilingual AI, and the use of AI to improve services for citizens and businesses. They will be supported by capabilities including Microsoft Sovereign Public Cloud, Sovereign Private Cloud, and Project Digital Shield, where relevant and available.
We will invest in subsea and terrestrial connectivity
Digital resilience depends on strong and reliable networks. Protecting subsea and terrestrial connectivity requires sustained cooperation between governments and the private sector, but the foundation of continuity is redundancy. A diverse network of high-capacity routes allows traffic to be rerouted around disruptions, minimizing latency and maintaining critical data flows.
Microsoft has helped expand both the capacity and reliability of digital connectivity across regions through investments in major international subsea cable systems, including SeaMeWe-6, which has landings in Qatar, Saudi Arabia, and the United Arab Emirates, as well as operating a global network spanning more than 275,000 miles of terrestrial and subsea fiber. During network disruptions, Microsoft has demonstrated the value of redundancy by rerouting traffic through Middle East corridors and maintaining service continuity with minimal impact on customers.
Building on this foundation, Microsoft plans to invest more than $400 million in subsea and terrestrial connectivity across the Middle East by 2030. This investment will expand capacity, strengthen regional data flows, and support Microsoft’s growing cloud and AI infrastructure footprint across the region.
We will build AI infrastructure with the planet in mind
As we expand our cloud and AI infrastructure in Kuwait, Qatar, Saudi Arabia, and the UAE, we will do so with a focus on responsible growth. Guided by Microsoft’s global goals to address carbon, water, waste, and ecosystems, we will work with our lessor partners to ensure that the cloud infrastructure supporting our services advances Microsoft’s water-positive ambitions, including by prioritizing zero-water cooling technologies where feasible.
Water resilience is particularly important across the Middle East. Building on Microsoft’s global experience advancing water stewardship through water reuse, replenishment, and innovative water management solutions, we will work with governments and local stakeholders to identify opportunities that advance responsible water stewardship across the region.
As AI accelerates economic opportunity across the Middle East, expanding access to clean energy will be essential to ensuring this growth is sustainable. We will also collaborate with regulators, utilities, and our lessor partners to help create the market conditions needed to expand carbon-free electricity procurement and stimulate new clean energy investment. By combining infrastructure investment with local partnerships and innovation, we aim to support the region’s energy and water priorities while helping build the sustainable foundations needed for long-term AI-led economic growth.
We will launch a new Middle East digital resilience initiative
Conflict in the Middle East has reinforced the connection between digital resilience and digital sovereignty. Microsoft has worked with customers to support business continuity through resilience options tailored to different operational and regulatory needs. Going forward, Microsoft will make digital resilience a cornerstone of its Middle East strategy, helping organizations strengthen continuity and recovery through digital resilience assessments, reference architectures, readiness guidance, continuity planning, and enablement programs that help identify vulnerabilities, protect critical data, and build tested recovery capabilities.
We will strengthen data protection, privacy, and business continuity
Microsoft will expand our existing commitments on data-protection sovereignty and business continuity to eligible governments and customers in Kuwait, Qatar, Saudi Arabia, and the UAE. These are designed to give organizations greater confidence in how their data, systems, and operations are protected while maintaining continuity in times of uncertainty. They will be complemented by Microsoft’s growing sovereign-cloud portfolio, including Sovereign Public Cloud and Sovereign Private Cloud capabilities, together with Project Digital Shield and other capabilities that support security, privacy, transparency, and operational resilience.
We will expand and strengthen cybersecurity cooperation
As Kuwait, Qatar, Saudi Arabia, and the UAE accelerate their digital transformation, cybersecurity has become a core pillar of national and economic security. As governments, critical infrastructure, and economies become more connected, cyber threats and influence operations can have consequences that extend far beyond physical borders. That’s why we are announcing that we are deepening our partnerships with the cybersecurity authorities in these countries.
A network of dedicated Microsoft cybersecurity champions in Kuwait, Qatar, Saudi Arabia, and the UAE will help governments translate these resources into action and connect national priorities with expertise across Microsoft. Stronger cybersecurity benefits far more than individual networks. It helps build trust to ensure digital transformation will succeed.
We will advance responsible AI through governance, assurance, and inclusion
Microsoft will work with governments, businesses, researchers, and civil society organizations across the Middle East to help people and institutions benefit from new technology. As AI advances, realizing its full potential will require not only access to powerful technology, but the governance, assurance, and skills required to deploy it confidently and responsibly.
We will help strengthen AI governance capabilities across the region and support practical approaches to testing, evaluating, and assurance systems. We will also expand collaboration with the Responsible AI Future Foundation (RAIFF), co-founded with G42 and the Mohamed bin Zayed University of Artificial Intelligence (MBZUAI), to support the development and sharing of responsible AI practices and evaluation tools that can be applied across high-impact AI use cases in the Middle East and beyond.
By helping organizations align with emerging international practices, we aim to strengthen confidence in AI systems, support responsible innovation, enhance global competitiveness, and ensure that the Middle East plays an active role in shaping the future of AI.
We will advance AI for Good research and innovation
Microsoft’s AI for Good Lab will continue to support the region through research and partnerships focused on food security, low-resource language development, and climate and disaster resilience. This includes work through initiatives such as the LINGUA program, which supports the development of language technologies for underserved communities.
In partnership with governments, NGOs, nonprofits, and research institutions, the AI for Good Lab will continue developing and scaling AI solutions that address real-world challenges across the Middle East and beyond.
We will prepare the next generation for the AI economy
We believe AI should enhance human ambition, strengthen human capability, and help prepare workers to thrive in a changing economy. That is why Microsoft will continue to invest in AI skills, workforce readiness, public-sector capability building, and inclusive talent development across Kuwait, Qatar, Saudi Arabia, and the UAE, building on existing commitments to help skill more than 4.2 million people by 2030.
This work includes training for public-sector leaders, students, and workers; initiatives focused on expanding opportunities for women; and partnerships with educational institutions across the region. This work builds on programs such as Saudi Arabia’s AI Global Leadership Program, AI Skills 4 Women programs in Saudi Arabia and Qatar, and the Women’s Datacenter Academy in Saudi Arabia. Microsoft will also engage with workforce coalitions that can support national talent strategies and policy recommendations.
We will help education communities prepare learners for the AI era
Microsoft is working with governments, educators, institutions, and partners across the Middle East to develop responsible AI principles across primary, secondary, and tertiary education. This includes supporting AI literacy, helping educators integrate AI into teaching and learning, and sharing practical guidance for responsible AI use in educational settings. Across Kuwait, Qatar, Saudi Arabia, and the UAE, we will work with local partners to ensure students and educators can benefit from AI safely, responsibly, and effectively and will engage educators, policymakers, industry leaders, and civil society to support practical approaches to AI implementation that reflect local priorities.
We will help empower workers in the AI economy
We will partner with governments, employers, workers, education providers, and other stakeholders to help people adapt to changing workplace demands. Our focus is on practical skills development, workforce readiness, and leadership development that helps countries build competitive economies and create new opportunities for workers in an AI-enabled future.
We will support local and national AI talent priorities across the Middle East
Microsoft is partnering with governments, academic institutions, and civil society organizations to support national talent priorities by advancing AI skills, leadership development, and workforce readiness programs for public-sector leaders, students, underrepresented talent, and people across the Middle East. The goal is to help countries build globally competitive workforces, accelerate innovation, and unlock new economic opportunities in the AI era.
While no one can predict the future, one thing is certain: Microsoft has been part of this region’s journey for more than 35 years, and we are committed to being a partner for the long term. We look forward to continuing to work alongside governments, businesses, educators, and communities to help build that future together.
The post Microsoft strengthens its commitment to the Middle East by investing in technology, digital resilience, and people appeared first on Microsoft On the Issues.
Microsoft has disrupted EvilTokens, a powerful cybercrime platform that used AI at every step of the attack chain—from compromising email accounts to designing intricate roadmaps for financial fraud and scams. While EvilTokens helped cybercriminals access email accounts, at the center of the service was an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed. The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts to help criminals trick victims into taking action.
In short, AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible.
Within months of launching in February 2026, EvilTokens had been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, showing how quickly the service gained traction. Microsoft observed the highest concentrations of victim activity in the United States, Canada, the United Kingdom, Australia, India, and France. Affected organizations ranged from wholesale distribution and construction to financial services, real estate, higher education, and healthcare. Working with partners, Microsoft seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure. In the United Kingdom, the Metropolitan Police Service’s cybercrime team arrested two men on suspicion of offenses connected with the alleged operation of EvilTokens.
But the significance of EvilTokens extends beyond its rapid growth and global reach. It offers an early warning of what happens when cybercriminals combine stolen access with AI capable of understanding how an organization works.
EvilTokens helped criminals gain access to email accounts by tricking victims into entering an authentication code on Microsoft’s legitimate sign-in page. By completing the normal authentication sign-in process, victims unknowingly gave criminals access to their email accounts without revealing their passwords. That access could persist even after a password reset if the associated sessions and tokens were not also revoked. Microsoft Threat Intelligence provides additional technical details about the operation, how device-code attacks work, and steps customers can take to protect themselves here.
Once inside an account, criminals have traditionally needed time and experience to sift through thousands of messages, identify decision-makers, understand payment processes, and find opportunities for fraud.
EvilTokens began automating that work. Its AI tools could summarize and translate emails, surface financial conversations, map organizational roles, identify trusted relationships, and recommend potential targets. Preset prompts offered to find wire-transfer discussions, identify the organization’s “money movers,” locate vendor invoices, and determine the best people to impersonate.
Sold through Telegram for a $1,500 initiation fee and a recurring $500 subscription, EvilTokens combined account compromise, mailbox analysis, target selection, and fraud preparation in a single service. Capabilities that once required experience across identity attacks, cloud systems, social engineering, and financial fraud were available through a ready-made interface.
Investigators found evidence that large portions of EvilTokens had been “vibe coded,” with AI helping its creators build the platform itself. They also determined that EvilTokens drew on capabilities from multiple AI models.
The result was more than a collection of attack tools. EvilTokens packaged much of the fraud process into a commercially run service, complete with subscription pricing, customer support, management dashboards, and tools designed to move customers from account access toward financial exploitation.
No single organization could disrupt EvilTokens alone. The service relied on hosting providers, cloud services, AI tools, financial services, and other online resources that cybercriminals repurposed to support fraud at scale.
The disruption combined civil legal action with coordinated operational work across industry and law enforcement. Because healthcare organizations were among those targeted, Health-ISAC—a global non–profit that helps health sector organizations share cyber threat information and collaborate to improve operational resilience—joined Microsoft’s legal action as a co-plaintiff.
With authorization from the U.S. District Court for the Eastern District of Virginia, Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs to act against key parts of the platform. Microsoft also notified affected customers, helped remediate compromised accounts, and shared intelligence to support further defensive and investigative action.
The operation also demonstrated the value of rapid cooperation between private-sector investigators and law enforcement. Microsoft worked closely with specialist officers from the Metropolitan Police Service’s cybercrime team, sharing intelligence that enabled officers to take operational action in the United Kingdom. On September 11, 2026, officers arrested two men, aged 32 and 38, and seized digital devices and other items for examination. Both men have been released on police bail subject to conditions while the investigation continues.
While EvilTokens used AI to identify targets and prioritize fraud opportunities, Microsoft investigators used reverse engineering and AI-powered tools to analyze evidence, accelerate the investigation, and identify the infrastructure supporting the service. The case shows how AI is changing not only how cybercriminals operate, but also how defenders investigate and disrupt them.
This action marks the Microsoft Digital Crimes Unit’s (DCU) 40th court-authorized disruption spanning nearly two decades of targeting cyber threat actors, malicious tools, and supporting infrastructure. It is also DCU’s first action against an end-to-end AI-enabled cybercrime service.
The infrastructure supporting EvilTokens has been disrupted, but the model it demonstrated will not disappear with it. As Microsoft notes in its 2026 Responsible AI Transparency Report, increasingly capable and accessible AI is being used to scale fraud, impersonation, and other forms of online abuse. EvilTokens offers an early example of how those capabilities can be combined with compromised accounts to accelerate financial fraud.
For organizations, the lesson is: assume that once an inbox is compromised, criminals may understand its contents in minutes, not days. Strong identity protections and monitoring remain essential, but organizations should also independently verify requests to change payment information, redirect funds, or approve unusual transactions through a trusted second channel.
The post Disrupting EvilTokens: The AI Chatbot Built for Cybercrime appeared first on Microsoft On the Issues.
Today we published our latest Global AI Diffusion Report. Global AI diffusion continued to climb in the second quarter of 2026. In June, AI usage was 18.8% of the working-age population worldwide, an increase of about 1% from the first quarter of this year. Growth was broad-based: almost every economy saw increased usage.
Notably, the UAE (73.3%) and Singapore (64.3%) continue to top the leaderboard. South Korea again saw the largest absolute change, with an increase of 3.5 percentage points. Saudi Arabia climbed five places from 30th to 25th, the largest rise in the rankings. Japan recorded the largest relative change, growing by 2.2 percentage points, or roughly 10% relative to its Q1 usage of 22.5%. Worldwide, the quarter brought a continued widening of the AI gap between the Global North and South, with usage now at 28.8% in the North and 16.2% in the South.
To track all these trends, we continue to measure AI diffusion as the share of people worldwide ages of 15 and 64 who have used a generative AI product during the reported period. This measure is derived from aggregated and anonymized Microsoft telemetry data and is adjusted to reflect differences in operating system and device market share, internet penetration, and population. Additional details on the methodology are available in our AI Diffusion technical paper.
No single metric is perfect, and this one is no exception. Through the Microsoft AI Economy Institute, we continue to refine how we measure AI diffusion globally, including how adoption varies across countries in ways that best advance priorities such as scientific discovery and productivity gains. For this report, we rely on the strongest cross-country measure available today. Over the past year, there has been a significant rise in new AI tools and models. For our next report, we will expand our measure to include usage of these new tools and expect this update to increase AI user share across almost all economies, with larger projected increases in China.
In addition to our comparison of AI diffusion between the Global North and the Global South, we also find important differences in how AI is being used. Using consumer Microsoft Copilot usage insights, we examined these differences. The most notable difference is a higher share of education and learning use in the Global South.
This report also includes a substantive discussion of open-weight AI models. Open-weight AI model use is increasingly visible through application programming interface (API) usage of AI, where open models have captured a growing share of token volume. This shift could especially benefit the Global South by lowering access costs and enabling adaptation to local languages and needs, although barriers such as infrastructure, connectivity, and skills remain.
Download the latest Global AI Diffusion report and explore the data here.
The post The continued state of global AI diffusion in 2026 appeared first on Microsoft On the Issues.
Login