AI-ATKPhoto: Kristin Hardwick / StockSnap (CC0)AI-Powered Attacks_
Deepfake fraud, AI phishing, AI-written malware
AI-ATKBOTNETJustice Department and partners disrupt Gootloader infrastructure
The Justice Department removed Gootloader from more than 100 servers and seized U.S. domains on Nov 12, 2026. The malware infected at least 25,000 computers worldwide.
AI-ATKPHISHFake OpenAI, SpaceX and Anthropic event pages blocked in phishing campaign
Push Security blocked visits to fake OpenAI, SpaceX and Anthropic event pages in late October 2026; HKCERT reported the campaign on Nov 5.
AI-ATKCRYPTOBinance attack took more than $6 billion in virtual assets
North Korea took more than $6 billion from Binance on or about Oct 29, the FBI said. Binance disclosed the incident on Nov 3.
AI-ATKTRADERBinance virtual assets: FBI attributes more than $6 billion to North Korea
The FBI attributed more than $6 billion in Binance virtual assets to North Korea’s TraderTraitor activity on or about Oct 29, 2026. The FBI and HKCERT disclosed the attribution on Oct 31, 2026.
AI-ATKPHISHHong Kong recorded 4,404 cybersecurity incidents in Q3 2026
HKCERT recorded 4,404 Hong Kong security incidents in Q3 2026, including 2,672 phishing cases. It disclosed the figures on Nov 4, 2026.
AI-ATKAINCSC warned AI ransomware could target UK critical infrastructure by 2028
The NCSC said AI-powered malware is highly likely to be used in ransomware attacks against Britain’s critical national infrastructure by 2028. It published the warning on Nov 3, 2026.
AI-ATKLLMGoogle: hijacked enterprise LLM access caused fraudulent charges
Threat actors hijacked enterprise access to large language models, creating fraudulent charges above $100,000 in a day, Google said on Nov 2, 2026.
AI-ATKAIVOLTA-AUTODOXER uses an LLM to rank victims’ assets
The Windows infostealer sends collected data to an LLM to rank assets by monetization value, Cisco Talos disclosed on Oct 31, 2026.
AI-ATKTEAMSMicrosoft Teams external chat abused in more than 400 incidents
Arctic Wolf analyzed more than 400 incidents abusing Microsoft Teams external chat, with payload execution in under 15 minutes after a victim engaged. It published its report Oct 26, 2026.
AI-ATKTEAMSMicrosoft Teams external chat abused to gain initial access
Attackers used Microsoft Teams external chat to impersonate IT support in more than 400 incidents, Arctic Wolf Labs said on Oct 26, 2026.
AI-ATKCYBEROperation Serengeti III arrests 1,462 suspects across 21 countries
Operation Serengeti III arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than USD 105 million, INTERPOL reported.
AI-ATKAICISA guidance aims to help organizations manage AI token consumption
CISA, Canada’s Cyber Centre and partners released guidance on managing AI token usage and service dependencies on Oct 22, 2026.
AI-ATKAIFake AI campaigns linked to 1,258 analyses by ANY.RUN
ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns targeting businesses between April and October 2026.
AI-ATKSRGSilent Ransom Group chats showed plans for physical intrusions and extortion
Recorded Future News said leaked chats described plans to enter U.S. law firms, kidnap business executives and recruit military personnel. The archive contained thousands of messages.
AI-ATKEXTORTTeen suspected of leading ShinyHunters detained amid Boeing unit extortion
KrebsOnSecurity reported that a teenager suspected of leading ShinyHunters was detained as the group was extorting a business unit recently divested by Boeing.
AI-ATKMFAFake AI advertising platform used browser-in-browser phishing
Island disclosed on Oct 6 a human-operated phishing platform disguised as AI advertising products, impersonating Gemini, Claude, ChatGPT and Perplexity and later adding Muse Ads.
AI-ATKSHINYJordanian authorities reportedly detained suspected ShinyHunters member Rey
Jordanian authorities reportedly detained suspected ShinyHunters member Saif al-Din Khader, known as Rey, on Sep 29, 2026. Reuters disclosed the account.
AI-ATKPHISHTA419 conducted credential-phishing campaigns targeting US AI experts
TA419 targeted US AI experts with credential-phishing campaigns in July, impersonating economists and AI-policy figures. Proofpoint disclosed the activity on Sep 30.
AI-ATKRATChatGPT Custom GPTs used in RAT campaign hitting at least 40 incidents
Huntress said attackers used ChatGPT Custom GPTs and malicious Google Sites links in a remote access trojan campaign affecting at least 40 incidents. It disclosed the campaign on Sep 28, 2026.
AI-ATKAISECClaude Mythos Preview completed control-flow hijacks in Anthropic tests
Claude Mythos Preview completed full control-flow hijacks in 6% of trials, Anthropic said in research published Sep 29, 2026.