Wiz Reports Surge in Cloud Supply-Chain Attacks and Threats to AI Infrastructure in H1 2026
Summary
Wiz says significant cloud incidents rose 60% in H1 2026, driven by supply-chain campaigns, credential theft, and growing attacks on AI infrastructure. Its report also details extortion activity, exposures, and defensive detections.
Key points
- Wiz reported a 60% rise in significant incidents versus H2 2025; supply-chain attacks more than doubled and accounted for 25% of incidents.
- TeamPCP’s campaigns compromised packages and developer toolchains, stole credentials, and used them to access cloud environments and repositories; some stolen tokens were reused weeks later.
- Other operations included North Korean package compromises, modified Shai-Hulud worms, and IronWorm, which used a Rust binary and an eBPF rootkit.
- Wiz tracked JINX-0163, a cloud-focused extortion group targeting service accounts and IAM roles; one intrusion exposed thousands of secrets across GCP projects.
- AI infrastructure saw more vulnerabilities and attacker activity. The report describes exposed unauthenticated MCP endpoints, insecure deployments, and attacks on model-serving environments.
- Wiz highlighted cloud attack techniques and audit-log signals, including suspicious access-key creation, Azure VM Run Command use, temporary IAM policy changes, and unusual AWS credential use.
- Wiz says its incident findings led to new or updated detections across cloud runtime, identity, and software supply-chain environments.
Article Details
- Publisher
- Wiz
- Report Period
- 2026-01-01 to 2026-06-30
- Scope
- Cloud threats, incidents, vulnerabilities, and attacker activity tracked by Wiz Research and CIRT during H1 2026.
- Key Statistics
- Significant incidents highlighted to customers increased 60% from H2 2025 and were nearly double the H1 2025 level.
- Supply-chain attacks increased from about 10% of significant incidents in H2 2025 to 25% in H1 2026.
- New vulnerability disclosures highlighted roughly doubled compared with H2 2025.
- Activity targeting AI infrastructure roughly doubled compared with H2 2025; affected tools were present in a third of monitored cloud environments.
- Exploitation of internet-facing appliances fell from 30% to 17% of significant incidents.
- Recommendations
- Set package cooldown policies to avoid downloading packages that have been available for less than 24 hours.
- Monitor CreateAccessKey events when the calling principal is not the account owner.
- Monitor Azure Activity Logs for VM Run Command calls.
- Monitor SetOrgPolicy calls on allowedPolicyMemberDomains from identities not known to be IAM administrators, especially when followed by SetIamPolicy in the same session.
- Investigate instance-role credential use when CloudTrail shows an operating-system mismatch and the Boto3 m/e (CREDENTIALS_CODE) feature flag.
Threat Actors
fulcrumsecIdentity used by an actor threatening victims with data release unless paid; Wiz assesses with moderate confidence that it is JINX-0163's public-facing identity, while noting an extortion-as-a-service possibility.JINX-0163Cloud-native extortion gang tracked by Wiz in 2026; Wiz attributes cloud-secret theft operations to the group.LAPSUS$Group that jointly listed GitHub internal repositories for sale with TeamPCP; a victim extorted by Lapsus$ was initially compromised through a key stolen in a TeamPCP campaign.MIDNIGHT NEPTUNEName used in the article for North Korea's supply-chain activity; the article gives UNC1069 as its associated identifier.North KoreaWiz attributes supply-chain operations, including trojanized npm packages, to North Korea.TeamPCPGroup identified by Wiz as running software supply-chain campaigns, including poisoned packages and credential theft.UNC1069Identifier associated in the article with Midnight Neptune, which it describes as North Korea's supply-chain activity.
Malware
Vendors
GitHubmoved through hundreds of organizations, drew public postmortems from several named victims and reached GitHub itself, which disclosed unauthorized access to its internal repositories after a poisoned VSCodeWizIn the first half of 2026, Wiz's Research and CIRT teams tracked threats affecting thousands of cloud environments.
Products
AURcampaigns during the same time period, across npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR. Several of those ecosystems hadn't been targeted this way before.AWSa full inventory of an organization's secrets. They have shown the ability to operate seamlessly across AWS, Azure, GCP, Okta and Snowflake and do so quickly and at scale.Azureworm was built on the open-sourced Shai-Hulud code but added cloud-identity collectors targeting GCP and Azure metadata services and generated a uniquely encrypted payload per infection so that no two compromisedBoto3credentials from a Linux host and use them from their own machine, the mismatch shows up in CloudTrail. Boto3 reads the local OS at runtime, so the user-agent field reveals the attacker's operating system rather thanCloudTrailrole credentials from a Linux host and use them from their own machine, the mismatch shows up in CloudTrail. Boto3 reads the local OS at runtime, so the user-agent field reveals the attacker's operating systemComposerthree independent operations were all running campaigns during the same time period, across npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR. Several of those ecosystems hadn't been targeted this wayDifyinjection vulnerability exploited in the wild, a privilege escalation chain and an authentication bypass. Dify, Langflow, n8n and Ollama each had critical unauthenticated vulnerabilities of their own.GCPThe worm was built on the open-sourced Shai-Hulud code but added cloud-identity collectors targeting GCP and Azure metadata services and generated a uniquely encrypted payload per infection so that no twoGitHub Actionsgrew more aggressive. The April-May variant was distributed via PyPI for the first time, exploited GitHub Actions CI misconfigurations to poison build caches and extracted OIDC tokens directly from runner memory. ByJenkinswere all running campaigns during the same time period, across npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR. Several of those ecosystems hadn't been targeted this way before.KubernetesAttackers with access to managed Kubernetes services can call the VM Run Command API against the underlying nodes and get root code execution outside the Kubernetes layer, bypassing container-level controls. VM RunLangflowvulnerability exploited in the wild, a privilege escalation chain and an authentication bypass. Dify, Langflow, n8n and Ollama each had critical unauthenticated vulnerabilities of their own.LiteLLMAI tools drew significantly more attention from attackers and security researchers. LiteLLM, an AI gateway present in over a third of the cloud environments we monitor, had four separate security events in six months: an8nexploited in the wild, a privilege escalation chain and an authentication bypass. Dify, Langflow, n8n and Ollama each had critical unauthenticated vulnerabilities of their own.npmand at least three independent operations were all running campaigns during the same time period, across npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR. Several of those ecosystems hadn't beenOktaof an organization's secrets. They have shown the ability to operate seamlessly across AWS, Azure, GCP, Okta and Snowflake and do so quickly and at scale.Ollamaexploited in the wild, a privilege escalation chain and an authentication bypass. Dify, Langflow, n8n and Ollama each had critical unauthenticated vulnerabilities of their own.PyPIat least three independent operations were all running campaigns during the same time period, across npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR. Several of those ecosystems hadn't been targetedSnowflakesecrets. They have shown the ability to operate seamlessly across AWS, Azure, GCP, Okta and Snowflake and do so quickly and at scale.Torcommon user-space tools . It also put more effort into obfuscating its communications, routing them over Tor. A second IronWorm operation emerged in early July.VS Codeoperations were all running campaigns during the same time period, across npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR. Several of those ecosystems hadn't been targeted this way before.