Cybersecurity firm Darktrace says cloud and SaaS environments are the top targets for attackers in the first half of 2026. The shift is notable: threat actors have moved away from malware and vulnerability exploitation toward identity compromise, now extending attacks to email authentication, AI gateways, and software supply chains.
One compromised SaaS account triggered malicious activity across email, SaaS, and network layers simultaneously — the kind of attack that's hard to catch because no single indicator looks alarming alone. Attackers also hijacked Axios, a JavaScript library downloaded 100 million times weekly, to spread remote access trojans.
Email phishing is getting sharper too — two-thirds of phishing emails now pass DMARC validation. Meanwhile, AI-generated malware and the world's first fully automated ransomware campaign, JadePuffer, signal that AI is rapidly closing the gap between vulnerability discovery and exploitation.
Source: Infosecurity Magazine