AI Threat Watch
RSS feed

Timeline

Volume per month and the reports that shaped each year. Must-reads are shown first. Switch to all entries for the full record.

2026

62 entries, 4 must-reads

January

  1. GreyNoise
    Threat Actors Actively Targeting LLMs (opens greynoise.io)
    Category
    AI-Targeted
  2. Breached.company
    The Lethal Trifecta Strikes: Four Major AI Agent Vulnerabilities in Five Days (opens breached.company)
    Category
    AI-Targeted
  3. Unit 42 (Palo Alto Networks)
    The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time (opens unit42.paloaltonetworks.com)
    Category
    AI-Enabled
  4. Resecurity
    Breaking Trust with Words: Prompt Injection Leading to Simulated /etc/passwd Disclosure (opens resecurity.com)
    Category
    AI-Targeted

February

  1. Snyk
    Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise (opens snyk.io)
    Category
    AI-Targeted
  2. Moonlock Lab
    Moonlock Lab thread on ClickFix malware abusing Claude.ai and Medium (opens x.com)
    Category
    AI-Targeted
  3. Google Threat Intelligence Group
    GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use (opens cloud.google.com)
    Category
    AI-Enabled
    Marker
    Must-read
  4. ESET Research
    PromptSpy ushers in the era of Android threats using GenAI (opens welivesecurity.com)
    Category
    AI-Enabled
  5. Amazon Threat Intelligence
    AI-augmented threat actor accesses FortiGate devices at scale (opens aws.amazon.com)
    Category
    AI-Enabled
  6. Hunt.io / cyberandramen.net
    LLMs in the Kill Chain: Inside a Custom MCP Targeting FortiGate Devices Across Continents (opens cyberandramen.net)
    Category
    AI-Enabled
  7. TrendAI Research
    Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer (opens trendaisecurity.com)
    Category
    AI-Targeted
  8. OpenAI
    Disrupting malicious uses of AI (opens openai.com)
    Category
    AI-Enabled
    Marker
    Must-read

March

  1. Moonlock Lab
    Fake VCs target crypto talent in a new ClickFix campaign (opens moonlock.com)
    Category
    AI-Enabled
  2. Palo Alto Networks Unit 42
    Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted
  3. IBM X-Force
    A Slopoly start to AI-enhanced ransomware attacks (opens ibm.com)
    Category
    AI-Enabled
  4. Unit 42
    Open, Closed and Broken: Prompt Fuzzing Finds LLMs Still Fragile Across Open and Closed Models (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted
  5. Datadog Security Labs
    LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaign (opens securitylabs.datadoghq.com)
    Category
    AI-Targeted

April

  1. Gambit Security
    A Single Operator, Two AI Platforms, Nine Government Agencies: The Full Technical Report (opens gambit.security)
    Category
    AI-Enabled
  2. OWASP GenAI Security Project
    OWASP GenAI Exploit Round-up Report Q1 2026 (opens genai.owasp.org)
    Category
    AI-Targeted
  3. Validin
    "Hello? I can't hear you": Investigating UNC1069's Fake Meeting Tactics (opens validin.com)
    Category
    AI-Targeted
  4. Abnormal AI
    AI Meets Voice Phishing: How ATHR Automates the Full TOAD Attack Chain (opens abnormal.ai)
    Category
    AI-Enabled
  5. Google
    AI threats in the wild: The current state of prompt injections on the web (opens blog.google)
    Category
    AI-Targeted

May

  1. Cloud Security Alliance
    Agent Context Poisoning: SKILL.md and the New AI Supply Chain Attack Surface (opens labs.cloudsecurityalliance.org)
    Category
    AI-Targeted
  2. Microsoft Security
    When prompts become shells: RCE vulnerabilities in AI agent frameworks (opens microsoft.com)
    Category
    AI-Targeted
  3. Trend Micro
    Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America (opens trendmicro.com)
    Category
    AI-Enabled
  4. Google Threat Intelligence Group
    GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access (opens cloud.google.com)
    Category
    AI-Enabled
    Marker
    Must-read
  5. Trend Micro
    Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud (opens trendmicro.com)
    Category
    AI-Targeted
  6. EclecticIQ
    SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer (opens blog.eclecticiq.com)
    Category
    AI-Targeted
  7. Trend Micro
    One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign (opens trendmicro.com)
    Category
    AI-Enabled
  8. Straiker
    Fake Claude Code, Real Malware: Inside the Campaign Targeting AI Developers (opens straiker.ai)
    Category
    AI-Targeted
  9. Permiso
    ChatGPhish: The Page Is the Payload (opens permiso.io)
    Category
    AI-Targeted

June

  1. Anthropic
    What we learned mapping a year's worth of AI-enabled cyber threats (opens anthropic.com)
    Category
    AI-Enabled
  2. FortiGuard Labs
    Threat Actors Weaponize AI Hype to Deliver AsyncRAT (opens fortinet.com)
    Category
    AI-Enabled
  3. Help Net Security
    Prompt injection still drives most agentic AI security failures in production (opens helpnetsecurity.com)
    Category
    AI-Targeted

July

  1. Sysdig
    JADEPUFFER: Agentic ransomware for automated database extortion (opens sysdig.com)
    Category
    AI-Enabled
  2. Zscaler ThreatLabz
    Indirect Prompt Injection in Web Content Targets AI Agents (opens zscaler.com:443)
    Category
    AI-Targeted
  3. Moonlock
    New Gaslight malware evades AI analysis (opens moonlock.com)
    Category
    AI-Targeted
  4. Flare
    Mycelium Framework: First Ever Witnessed AI-as-a-Service Botnet (opens flare.io)
    Category
    AI-Enabled
  5. Elastic Security Labs
    REF6045: Mexican banking fraud toolkit with signs of AI-assisted development (opens elastic.co)
    Category
    AI-Enabled
  6. Tel Aviv University
    Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting (opens sites.google.com)
    Category
    AI-Targeted
  7. Hunt.io
    Suspected Chinese Operators Use Claude Code and DeepSeek to Target Government and Financial Systems Across Four Countries (opens hunt.io)
    Category
    AI-Enabled
  8. Zscaler
    ClaudeFix: Shared Claude Chats Meet ClickFix (opens zscaler.com:443)
    Category
    AI-Enabled
  9. Hugging Face
    Security incident disclosure , July 2026 (opens huggingface.co)
    Category
    AI-Targeted
  10. Darkatlas
    APT42: AI-Assisted Rapport Phishing and a More Resilient TAMECAT Backdoor (opens darkatlas.io)
    Category
    AI-Enabled
  11. Sophos
    AI Security 2026 (opens assets.sophos.com)
    Category
    AI-Enabled
  12. Huntress
    Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT (opens huntress.com)
    Category
    AI-Targeted
  13. Anthropic
    Investigating three real-world incidents in our cybersecurity evaluations (opens anthropic.com)
    Category
    AI-Targeted

August

  1. Genians Security Center
    Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM (opens genians.co.kr)
    Category
    AI-Enabled
  2. Pillar Security
    Deadbugz: Currently Active MCP Supply-Chain Campaign (opens pillar.security)
    Category
    AI-Targeted
  3. SpecterOps
    Blacklight: Illuminating AI Agent Artifacts for Attackers and Defenders (opens specterops.io)
    Category
    AI-Targeted
  4. Cisco Talos
    UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations (opens blog.talosintelligence.com)
    Category
    AI-Enabled
  5. Cyera
    Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning (opens cyera.com)
    Category
    AI-Targeted
  6. Trail of Bits
    VMs won't contain cyber-capable agents (opens blog.trailofbits.com)
    Category
    AI-Enabled
  7. Gambit Security
    Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation (opens gambit.security)
    Category
    AI-Enabled
  8. Huntress
    The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms (opens huntress.com)
    Category
    AI-Targeted
  9. Unit 42
    Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted

September

  1. Unit 42
    Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America (opens origin-unit42.paloaltonetworks.com)
    Category
    AI-Enabled
  2. Genians
    Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve (opens genians.co.kr)
    Category
    AI-Enabled
  3. Gen Digital
    Infostealers Have Found a New Target: Your AI Agent (opens gendigital.com)
    Category
    AI-Targeted
  4. JFrog Security Research
    New packages identified in GemStuffer 'OpenAI Swarm' malicious RubyGems campaign (opens research.jfrog.com)
    Category
    AI-Enabled
  5. Sophos
    Devil’s advocate? Uncensored Luciferus AI service advertised underground (opens sophos.com)
    Category
    AI-Enabled
  6. Anthropic
    Detecting and countering misuse of AI: September 2026 (opens anthropic.com)
    Category
    AI-Enabled
    Marker
    Must-read

2025

36 entries, 4 must-reads

January

  1. Trend Micro
    Invisible Prompt Injection: A Threat to AI Security (opens trendmicro.com)
    Category
    AI-Targeted
  2. Google DeepMind
    How we estimate the risk from prompt injection attacks on AI systems (opens blog.google)
    Category
    AI-Targeted
  3. Google Threat Intelligence Group
    Adversarial Misuse of Generative AI (opens cloud.google.com)
    Category
    AI-Enabled
    Marker
    Must-read
  4. Wiz Research
    Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History (opens wiz.io)
    Category
    AI-Targeted
  5. Abnormal AI
    How GhostGPT Empowers Cybercriminals with Uncensored AI (opens abnormal.ai)
    Category
    AI-Enabled
  6. Unit 42
    Recent Jailbreaks Demonstrate Emerging Threat to DeepSeek (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted

February

  1. Unit 42
    Investigating LLM Jailbreaking of Popular Generative AI Web Products (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted

April

  1. Anthropic
    Operating Multi-Client Influence Networks Across Platforms (opens cdn.sanity.io)
    Category
    AI-Enabled
  2. Unit 42, Palo Alto Networks
    False Face: Unit 42 Demonstrates the Alarming Ease of Synthetic Identity Creation (opens unit42.paloaltonetworks.com)
    Category
    AI-Enabled

May

  1. EclecticIQ
    Storm-1516 Deploys AI-Generated Media to Spread Disinformation: Targets European Leaders and Influences Istanbul Peace Talks (opens blog.eclecticiq.com)
    Category
    AI-Enabled

June

  1. SecurityWeek
    'EchoLeak' AI Attack Enabled Theft of Sensitive Data via Microsoft 365 Copilot (opens securityweek.com)
    Category
    AI-Targeted
  2. Zscaler ThreatLabz
    Black Hat SEO Poisoning Search Engine Results For AI to Distribute Malware (opens zscaler.com:443)
    Category
    AI-Enabled
  3. Check Point Research
    In the Wild: Malware Prototype with Embedded Prompt Injection (opens research.checkpoint.com)
    Category
    AI-Targeted
  4. Cisco Talos
    Cybercriminal abuse of large language models (opens blog.talosintelligence.com)
    Category
    AI-Enabled

July

  1. guardsix
    LAMEHUG: APT28's New Arsenal - First AI-Powered Malware Explained (opens guardsix.com)
    Category
    AI-Enabled

August

  1. The Hacker News
    Cursor AI Code Editor Fixed Flaw Allowing Attackers to Run Commands via Prompt Injection (opens thehackernews.com)
    Category
    AI-Targeted
  2. Securelist
    Phishing and scams: how fraudsters are deceiving users in 2025 (opens securelist.com)
    Category
    AI-Enabled
  3. ESET Research
    First known AI-powered ransomware uncovered by ESET Research (opens welivesecurity.com)
    Category
    AI-Enabled
  4. Anthropic
    Threat Intelligence Report: August 2025 (opens anthropic.com)
    Category
    AI-Enabled
    Marker
    Must-read

September

  1. Netskope
    Securing LLM Superpowers: When Tools Turn Hostile in MCP (opens netskope.com)
    Category
    AI-Targeted
  2. Kaspersky Securelist
    Malicious MCP servers used in supply chain attacks (opens securelist.com)
    Category
    AI-Targeted
  3. Unit 42 (Palo Alto Networks)
    The Risks of Code Assistant LLMs: Harmful Content, Misuse and Deception (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted
  4. Genians
    AI-Driven Deepfake-Based Military ID Forgery APT Campaign (opens genians.co.kr)
    Category
    AI-Enabled
  5. Securelist
    A new RevengeHotels campaign targets Latin America (opens securelist.com)
    Category
    AI-Enabled
  6. Dataconomy
    SentinelOne finds MalTerminal malware using OpenAI GPT-4 (opens dataconomy.com)
    Category
    AI-Enabled
  7. Koi Security
    First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails (opens koi.ai)
    Category
    AI-Targeted
  8. ESET Research
    DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception (opens welivesecurity.com)
    Category
    AI-Enabled

October

  1. OpenAI
    Disrupting malicious uses of AI: October 2025 (opens openai.com)
    Category
    AI-Enabled
  2. Volexity
    APT Meets GPT: Targeted Operations with Untamed LLMs (opens volexity.com)
    Category
    AI-Enabled

November

  1. Google Threat Intelligence Group
    GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools (opens cloud.google.com)
    Category
    AI-Enabled
    Marker
    Must-read
  2. Infosecurity Magazine
    Claude Desktop Extensions Vulnerable to Web-Based Prompt Injection (opens infosecurity-magazine.com)
    Category
    AI-Targeted
  3. Anthropic
    Disrupting the first reported AI-orchestrated cyber espionage campaign (opens anthropic.com)
    Category
    AI-Enabled
    Marker
    Must-read
  4. Netskope
    The Future of Malware is LLM-powered (opens netskope.com)
    Category
    AI-Enabled
  5. Unit 42
    The Dual-Use Dilemma of AI: Malicious LLMs (opens unit42.paloaltonetworks.com)
    Category
    AI-Enabled

December

  1. Unit 42 (Palo Alto Networks)
    New Prompt Injection Attack Vectors Through MCP Sampling (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted
  2. Huntress
    AI-Poisoning & AMOS Stealer: The Biggest Mac Threat (opens huntress.com)
    Category
    AI-Enabled

2024

17 entries, 1 must-read

February

  1. Trend Micro
    A Deepfake Scammed a Bank out of $25M , Now What? (opens trendaisecurity.com)
    Category
    AI-Enabled
  2. Microsoft Threat Intelligence
    Staying ahead of threat actors in the age of AI (opens microsoft.com)
    Category
    AI-Enabled
    Marker
    Must-read

May

  1. OpenAI
    AI and Covert Influence Operations: Latest Trends (opens cdn.openai.com)
    Category
    AI-Enabled

June

  1. Google Threat Analysis Group
    Google disrupted over 10,000 instances of DRAGONBRIDGE activity in Q1 2024 (opens blog.google)
    Category
    AI-Enabled

July

  1. FBI
    State-Sponsored Russian Media Leverages Meliorator Software for Foreign Malign Influence Activity (opens ic3.gov)
    Category
    AI-Enabled
  2. Mandiant
    Whose Voice Is It Anyway? AI-Powered Voice Spoofing for Next-Gen Vishing Attacks (opens cloud.google.com)
    Category
    AI-Enabled
  3. Trend Micro
    AI-Powered Deepfake Tools Becoming More Accessible Than Ever (opens trendmicro.com)
    Category
    AI-Enabled

August

  1. Trend Micro
    Social Media Malvertising Campaign Promotes Fake AI Editor Website for Credential Theft (opens trendmicro.com)
    Category
    AI-Enabled
  2. The CyberWire
    Black Basta and the Use of LLMs by Threat Actors (opens thecyberwire.com)
    Category
    AI-Enabled
  3. Unit 42
    The Emerging Dynamics of Deepfake Scam Campaigns on the Web (opens unit42.paloaltonetworks.com)
    Category
    AI-Enabled

September

  1. Knostic
    Jailbreaking Social Engineering via Adversarial Digital Twins (opens knostic.ai)
    Category
    AI-Enabled

October

  1. Permiso
    When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying (opens permiso.io)
    Category
    AI-Targeted
  2. Unit 42 (Palo Alto Networks)
    Deceptive Delight: Jailbreak LLMs Through Camouflage and Distraction (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted

November

  1. Unit 42
    ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted

December

  1. Trend Micro
    Link Trap: GenAI Prompt Injection Attack (opens trendmicro.com)
    Category
    AI-Targeted
  2. Unit 42
    Now You See Me, Now You Don’t: Using LLMs to Obfuscate Malicious JavaScript (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted
  3. Unit 42 (Palo Alto Networks)
    Bad Likert Judge: A Novel Multi-Turn Technique to Jailbreak LLMs by Misusing Their Evaluation Capability (opens unit42.paloaltonetworks.com)
    Category
    AI-Targeted

2023

9 entries, 0 must-reads

January

  1. Check Point Research
    OPWNAI : Cybercriminals Starting to Use ChatGPT (opens research.checkpoint.com)
    Category
    AI-Enabled
  2. Recorded Future
    I, Chatbot (opens recordedfuture.com)
    Category
    AI-Enabled

February

  1. Check Point Research
    Cybercriminals Bypass ChatGPT Restrictions to Generate Malicious Content (opens blog.checkpoint.com)
    Category
    AI-Enabled
  2. Securelist
    IoC detection experiments with ChatGPT (opens securelist.com)
    Category
    AI-Targeted

May

  1. Recorded Future
    I Have No Mouth, and I Must Do Crime (opens recordedfuture.com)
    Category
    AI-Enabled

June

  1. Unit 42
    Android Malware Impersonates ChatGPT-Themed Applications (opens unit42.paloaltonetworks.com)
    Category
    AI-Enabled

July

  1. Netenrich
    FraudGPT: The Villain Avatar of ChatGPT (opens netenrich.com)
    Category
    AI-Enabled

August

  1. LevelBlue (SpiderLabs)
    WormGPT and FraudGPT - The Rise of Malicious LLMs (opens levelblue.com)
    Category
    AI-Enabled

December

  1. Recorded Future
    Obfuscation and AI Content in the Russian Influence Network “Doppelgänger” Signals Evolving Tactics (opens recordedfuture.com)
    Category
    AI-Enabled