CrowdStrike’s 2026 Threat Hunting Report: AI Is Now the Weapon, the Target and the Infrastructure of Modern Cyberattacks

Two hundred thousand AI model requests in two minutes. That is the pace at which one observed adversary campaign abused an enterprise large language model during the twelve months CrowdStrike’s threat hunters were watching — not a targeted probe, not a manual attack, but an automated pipeline using AI to do what human attackers cannot do at speed: generate, test, and execute attack variations in the time it takes a security analyst to read a single alert. The campaign is one data point in a report full of them, and collectively they describe a fundamental shift in what cybersecurity defenders are dealing with.

CrowdStrike released its 2026 Threat Hunting Report on August 3, 2026, drawing on telemetry from its OverWatch managed threat hunting team covering July 2025 through June 2026. The dataset is substantial: more than 7 trillion security events processed daily, distilled into approximately 14 million daily detection leads and around 36,000 customer alerts per year, across more than 290 named adversaries tracked by CrowdStrike’s intelligence analysts. The report’s central finding is not a new trend but a confirmation that a threshold has been crossed: AI is no longer a supplementary tool used by some adversaries in some campaigns. It is embedded across modern adversary operations as a tool for attack, a target for compromise, and an operational force multiplier for scaling what was previously limited by human time and attention.

The Three-Part Adversary AI Framework

Adam Meyers, CrowdStrike’s Senior Vice President for Counter Adversary Operations, framed the report’s core finding in terms that make the strategic shift clear: ‘The same AI tools driving modern businesses are creating under-defended attack surfaces that adversaries are exploiting.’ The official Business Wire release organises the threat picture around three distinct adversary AI roles, each distinct in mechanism but increasingly connected in practice. AI as a tool: adversaries are using AI models to generate malicious payloads, write shell commands, identify targets, and produce credential-harvesting scripts at machine speed. AI as a target: adversaries are specifically attacking AI infrastructure — the models, the APIs, the software frameworks, and the development pipelines that enterprises use to build and run their AI systems. AI as a force multiplier: AI is enabling the scaling of attack volume and velocity beyond what human operators could achieve manually, from automated phishing at millions of recipients to the 200,000-request-in-two-minutes LLM abuse campaign.

China-Nexus Actors: 24-Hour Exploitation

From Disclosure to Exploitation in One Day

Among the most operationally significant findings in the report is the confirmation that China-nexus state threat actors have reduced their average time from public vulnerability disclosure to active exploitation to within 24 hours of proof-of-concept publication. A proof-of-concept is the specific demonstration code that security researchers publish when they document a vulnerability, showing how the flaw can be exploited in practice. In the pre-AI era, the window between PoC publication and widespread exploitation was typically days to weeks — enough time for enterprise security teams to patch affected systems before the majority of adversary campaigns had developed working exploits. The 24-hour window confirmed in the report closes that gap dramatically: a vulnerability disclosed on Monday morning may be under active exploitation by Tuesday before many organisations have completed their initial vulnerability assessment.

AI Automation as the Enabling Mechanism

The mechanism behind this acceleration is AI-assisted exploit development. Human security researchers writing exploits from a PoC typically require hours to days to translate a proof-of-concept into a reliable, weaponised exploit that works across the range of target configurations in a production enterprise environment. AI-assisted exploit development — using AI models trained on vulnerability data, CVE descriptions, and security research to accelerate the translation from PoC to working exploit — compresses that timeline significantly. CrowdStrike’s observation that China-nexus actors are operating within the 24-hour window is consistent with the use of AI-assisted tooling for exploit development, though the report does not attribute the specific mechanism to a confirmed single technique. The implication for enterprise defenders is practical and urgent: the effective patch window for critical vulnerabilities disclosed with public PoC has shortened from days to hours.

The DPRK Supply Chain Attack: 131 AI Framework Packages

STARDUST CHOLLIMA’s Mastra Campaign

The most detailed supply chain attack documented in the report involves STARDUST CHOLLIMA, the CrowdStrike designation for a North Korea-nexus adversary group. The campaign involved the injection of a malicious npm package into 131 trusted Mastra AI framework packages — Mastra being an AI development toolkit used by developers building AI agents and workflows. By compromising packages within an AI framework rather than a standalone application, STARDUST CHOLLIMA positioned malicious code inside the development dependency that developers install when they build AI-powered applications. Every developer or organisation that installed the compromised Mastra packages was potentially deploying STARDUST CHOLLIMA’s code into their own systems, typically with the elevated privileges that development environments require.

Why AI Frameworks Are High-Value Supply Chain Targets

The choice of an AI framework as the supply chain attack vector is not incidental. AI frameworks occupy an unusually privileged position in modern enterprise technology stacks: they have extensive system access rights (to enable AI agents to interact with the environments they operate in), they are typically installed in development and production environments simultaneously, and they are often updated frequently as AI capabilities evolve — each update cycle providing a new opportunity for malicious code to be introduced. The Mastra campaign parallels a broader pattern documented in our earlier reporting on agentjacking attacks targeting AI coding agents: the same broad system access that makes AI agents useful for automating development workflows makes them high-value targets for adversaries who want persistent, privileged access to enterprise environments. Meyers put it directly: ‘The AI ecosystem is the next software supply chain battleground.’ Compromising a developer tool or software package provides downstream access to numerous organisations simultaneously — a force multiplication that individual enterprise compromises cannot match.

eCrime at Machine Speed: ALTERED SPIDER’s 300-Dependency Attack

The eCrime dimension of the report centres on ALTERED SPIDER, a financially motivated threat actor that compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments. The 300-dependency compromise in one day represents a level of operational throughput that is only achievable with automation: the identification of vulnerable packages, the insertion of malicious code, and the monitoring of credential harvests across hundreds of simultaneously compromised targets are not activities that human-paced operations can execute at that scale. The campaign’s structure — targeting software dependencies used by developers to harvest credentials and then pivoting into cloud infrastructure — reflects the same supply-chain logic that makes the STARDUST CHOLLIMA Mastra attack compelling: compromise what developers trust, and you inherit access to what developers have access to.

The 87 percent figure for npm package involvement in software registry threats in H1 2026 contextualises why npm packages are the preferred attack vector. The npm ecosystem — the package registry used by JavaScript and Node.js developers — hosts over 2 million packages and is installed in virtually every modern web application development pipeline. Its sheer ubiquity makes it the highest-yield supply chain attack surface: one malicious npm package inserted into a popular dependency can reach millions of downstream installations within days of publication. CrowdStrike’s broader Technology Threat Landscape Report, published in June 2026, separately documented STARDUST CHOLLIMA’s compromise of the Axios npm package — downloaded 100 million times per week — as a parallel example of how high-value npm compromise operates at scale.

Enterprise LLM Abuse: AI Infrastructure as Attack Surface

The campaign that sent 200,000 AI model requests in two minutes represents a category of adversary behaviour that was not operationally relevant twelve months ago: the weaponisation of enterprise AI APIs and LLM endpoints as targets rather than just tools. Enterprise LLM deployments — internal chatbots, AI-assisted coding tools, enterprise AI search systems — have system access to sensitive data, user credentials, and internal documentation that makes them high-value targets for credential extraction and data exfiltration. A campaign that can send 200,000 requests in two minutes is probing the target LLM for vulnerability disclosures, attempting jailbreaks, extracting embedded training data, or testing the system’s access controls at machine speed — none of which was a meaningful threat category before enterprises began deploying AI systems with meaningful internal access. The connection to the supply chain attacks targeting AI model dependencies documented in the Miasma worm incident is direct: adversaries are attacking AI infrastructure through both the dependency layer (supply chain poisoning) and the application layer (direct LLM abuse), creating a two-sided threat to enterprise AI deployments that conventional security controls were not designed to address.

The 2.5x Detection Lead Growth: AI Defenders vs AI Attackers

One of the report’s most quantifiable signals is the finding that AI agent-triggered detection leads grew at 2.5 times the rate of human-triggered detection leads during the reporting period. This figure captures the dynamic in concrete terms: adversaries are increasingly deploying AI-automated attack activity at volumes that human-triggered activity cannot match. For the defender, this has two implications. The first is volume: AI-enabled adversaries generate significantly more activity to investigate, overwhelming security operations centres that are staffed for human-paced attack volumes. The second is speed: AI-triggered attack activity moves faster through the attack chain than human-operated activity, reducing the time defenders have to detect and respond before damage is done. The 2.5x ratio quantifies how far along this shift has already progressed and implies that the ratio will continue to grow as AI capabilities improve and more adversary groups adopt AI-augmented operations.

What Defenders Should Take From This Report

CrowdStrike’s recommendations from the report focus on three areas that flow directly from the documented threats. First, vulnerability management timelines must compress: if China-nexus actors are exploiting within 24 hours of PoC publication, security teams need patch deployment processes and compensating controls that can operate on that timeline rather than the week-to-month timescales that most enterprise patching cycles assume. Second, AI development pipelines and software dependencies need the same security scrutiny as production systems: the STARDUST CHOLLIMA and ALTERED SPIDER campaigns both entered via development infrastructure that had less mature security controls than the production systems they were ultimately targeting. Third, AI system access controls need to be treated as critical infrastructure security rather than application configuration: enterprise LLMs and AI agents with broad system access are high-value targets that warrant dedicated security controls and monitoring, not just authentication.

What Happens Next

The trajectory the report documents — AI-enabled adversary operations growing in volume, velocity, and targeting sophistication — has no natural ceiling in the near term. The same improvements in AI capability that increase enterprise AI value also increase the capabilities available to adversaries who use those same tools. CrowdStrike’s threat intelligence suggests that adversary groups are actively investing in AI capability acquisition: DPRK-nexus actors are specifically targeting AI companies for IP theft, and China-nexus actors are engaged in sustained campaigns to steal AI models and training data they cannot develop at equivalent speed domestically. The adversary AI capability curve is being driven by the same global AI development investment that is driving enterprise AI capability — which means the capability gap between enterprise defenders and AI-enabled adversaries is unlikely to grow in defenders’ favour without equivalent investment in AI-powered defence.

Why It Matters

The CrowdStrike 2026 Threat Hunting Report matters because it provides empirical, telemetry-based confirmation of a threat landscape shift that has been theorised but not previously documented at this scale. The 7 trillion daily security events, 290-plus named adversaries, and twelve months of continuous tracking provide the most comprehensive real-world evidence available of how AI has been integrated into adversary operations. The three-part framework — AI as tool, target, and force multiplier — is not a marketing concept but a documented operational reality affecting enterprises across every sector. For security leaders and practitioners, the report’s most urgent message is practical: the vulnerability exploitation timeline has compressed to 24 hours, the software supply chain is being attacked through AI framework dependencies, and enterprise AI infrastructure is itself a target. The defences required to address those three threat categories simultaneously are more extensive than most enterprise security programmes currently have in place.

Sources

CrowdStrike 2026 Threat Hunting Report, Business Wire, August 3, 2026. CyberScoop, August 3, 2026 (Adam Meyers quotes). Security Brief Asia/Pacific, August 3, 2026. IT Brief Asia, August 3, 2026. StockTitan/Business Wire full release text, August 3, 2026.