AI assistants were observed as an execution proxy.
In August 2026, two intrusions ran their entire chain as children of a sanctioned AI client, one on Windows and one on macOS. This allowed the attacker to abuse trust and evade standard download defenses before our process lineage monitoring successfully identified both events.
Blockchain-based command and control went mainstream.
This command-and-control technique was first observed in June 2026, being used in atailored crypto implant. By late August, this technique delivered widespread trojanized packages through the legitimate npm registry infrastructure, showing rapid adoption from a tailored to a commodity application.
