Google’s 2026 Cybersecurity Forecast Highlights AI Attacks, Extortion and Nation-State Threats
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Google’s 2026 forecast anticipates wider adversary use of AI, continued ransomware and data-theft extortion, attacks on virtualization and crypto, and evolving nation-state operations; it also urges stronger AI governance and layered defenses.
Key points
- Google expects threat actors to expand AI use in social engineering, malware development and attack automation, with more prompt-injection attacks against enterprise AI systems.
- The report forecasts more AI-assisted voice phishing and warns that unauthorized workplace AI agents could expose sensitive data; it recommends governance, monitoring and agent-specific access controls.
- Google says 2,302 victims were listed on data leak sites in Q1 2025, the highest quarterly count it had observed since tracking began in 2020, and expects ransomware and extortion to remain highly disruptive.
- The forecast warns that attackers may increasingly target virtualization infrastructure, where limited monitoring and outdated software could enable rapid, widespread disruption.
- Google anticipates continued attacks on cryptocurrency organizations and DeFi, and says criminals may move more operations onto public blockchains.
- The report expects Russia-, China-, Iran- and North Korea-linked operations to continue pursuing espionage, disruption, influence and financial objectives, with priorities varying by country.
- Recommended defenses include AI governance and least-privilege access, OT/IT network segmentation, MFA for remote access, and immutable offline backups.
Article Details
- Publisher
- Report Period
- 2026
- Scope
- Forecast of cybersecurity threats and defensive priorities for 2026, informed by trends and activity observed in 2025.
- Key Statistics
- 2,302 victims were listed on data leak sites in Q1 2025, the highest single-quarter count observed since tracking began in 2020.
- Incidents targeting retail and food wholesale supply chains in 2025 caused hundreds of millions of dollars in total damages, according to the report.
- A cryptocurrency heist in 2025 was valued at approximately $1.5 billion; the report describes it as the largest recorded cryptocurrency heist.
- Recommendations
- Defend AI systems against prompt injection with model hardening, system-level guardrails, malicious-instruction filtering, output sanitization, and user confirmation for high-risk actions.
- Deploy AI controls to route and monitor agent traffic, and establish AI security governance that supports auditable use.
- Use multiple checks and balances to defend against vishing and other targeted social-engineering tactics.
- Segment OT from IT, secure remote access with MFA and least privilege, maintain immutable offline backups, and monitor critical IT/OT network paths.
People
Threat Actors
ShinyHuntersNamed as a sophisticated threat actor expected to accelerate AI-enabled social engineering; the article gives UNC6240 parenthetically as its associated name.UNC6240The article gives UNC6240 parenthetically alongside ShinyHunters as its associated name; the group is described in the context of AI-enabled social engineering.
Vendors
Products
ESXiGoogle Cloud VMware Engine (GCVE) enhances security by leveraging managed services and restricting direct access to underlying components like ESXi.Google Cloud VMware EngineGoogle Cloud VMware Engine (GCVE) enhances security by leveraging managed services and restricting direct access to underlying components like ESXi.
Countries
ChinaIn 2026, the volume of China-nexus cyber operations is expected to continue surpassing that of other nations.IranThe escalating regional tensions—exemplified by the Gaza conflict and the exchange of strikes between Iran, Israel, and the U.S.IsraelThe escalating regional tensions—exemplified by the Gaza conflict and the exchange of strikes between Iran, Israel, and the U.S.North Korea- [North Korea](#north-korea)PolandElections will remain a prime target, as seen in activities related to polls in Poland, Germany, Canada, and Moldova in 2025.RussiaIn 2026 and beyond, Russia’s cyber operations are expected to undergo a strategic shift, moving past a singular focus on short-term tactical support for the conflict in Ukraine to prioritize long-term global strategicSouth Koreaspecifically by portraying China positively, while negatively framing the U.S., Taiwan, Japan, South Korea, Vietnam, the Philippines, and critics of China.Taiwanstrategic interests, specifically by portraying China positively, while negatively framing the U.S., Taiwan, Japan, South Korea, Vietnam, the Philippines, and critics of China.Ukrainea strategic shift, moving past a singular focus on short-term tactical support for the conflict in Ukraine to prioritize long-term global strategic goals.United StatesAttacks will also continue against regions demonstrating a favorable regulatory stance and growing industry presence, such as the U.S., Southeast Asia, and the Middle East.
Industries
CryptocurrencyWe foresee continued high-value targeting of decentralized finance (DeFi) platforms and cryptocurrency exchanges, including large-scale attacks, and supply chain attacks combined with digital asset theft.DefenseThis involves a multi-layered defense-in-depth approach that includes model hardening, along with system-level guardrails.Financial sectorAs the financial sector adopts cryptocurrencies and tokenized assets, and moves towards a global on-chain economy, we anticipate threat actors will exploit blockchain characteristics like immutability andFood wholesaleFor context, incidents in 2025 targeting critical points in retail and food wholesale supply chains resulted in hundreds of millions of dollars in total damages, significantly disrupting consumer supply.RetailFor context, incidents in 2025 targeting critical points in retail and food wholesale supply chains resulted in hundreds of millions of dollars in total damages, significantly disrupting consumer supply.semiconductorOne area of particular interest for these operations will be the semiconductor sector, where competition, U.S.