CrowdStrike 2026 Threat Hunting Report Highlights Faster Exploitation and Rising Identity Attacks
Report discovered via Awesome Annual Security Reports.
Summary
CrowdStrike’s 2026 Threat Hunting Report finds faster exploitation, doubled vishing intrusions, and growing cloud abuse. Covering July 2025–June 2026, it details how attackers exploit trusted identities and developer ecosystems.
Key points
- The report covers July 1, 2025–June 30, 2026, expanding its scope from interactive intrusions to include automated attacks; overall observed intrusion activity increased approximately 4%.
- From January through June 2026, 88% of CrowdStrike-observed exploitation involving vulnerabilities with public proofs of concept occurred within 48 hours of PoC release.
- Malicious npm packages accounted for 87% of identified malicious registry packages in the first half of 2026. CrowdStrike reports that ALTERED SPIDER compromised more than 300 software dependencies in one day.
- Vishing intrusions doubled in the first half of 2026 compared with the preceding six months. CORDIAL SPIDER and SNARKY SPIDER used SSO-themed phishing to steal credentials and MFA codes, establish persistence, and access SaaS data.
- Financially motivated cloud-conscious activity rose 171% during the reporting period, while monthly device code phishing attempts increased fifteenfold over the last six months.
- A May 2026 LLMJacking campaign used a compromised cloud identity with a long-term access key and generated nearly 200,000 API requests in an initial two-minute flood before throttling.
- Recommendations include phishing-resistant MFA, monitoring unusual device enrollment and cloud activity, protecting developer identities, validating dependencies, and continuous exposure assessment and threat hunting.
Article Details
- Publisher
- CrowdStrike
- Report Period
- 2025-07-01 to 2026-06-30
- Scope
- Global CrowdStrike OverWatch observations of interactive intrusions and automated attacks across endpoint, identity, cloud, SaaS, developer, and AI environments.
- Key Statistics
- From January through June 2026, 88% of CrowdStrike-observed exploitation of vulnerabilities with a public PoC occurred within 48 hours of the PoC's release.
- Malicious npm packages accounted for 87% of identified malicious software registry packages in the first half of 2026.
- OverWatch detected twice as many intrusions involving vishing as the likely initial access vector in the first half of 2026 as in the second half of 2025.
- Cloud-conscious eCrime activity increased 171% over the reporting period.
- Monthly device code phishing attempts increased 15-fold over the last six months of the reporting period.
- Recommendations
- Enforce phishing-resistant MFA and least-privilege access; monitor anomalous sign-ins, atypical MFA device enrollment, suspicious token use, and mass SaaS file access.
- Continuously monitor cloud control plane activity for anomalous API sequences, resource provisioning, secret access, and cross-account trust changes.
- Harden developer environments, protect maintainer identities, enforce code signing and dependency validation, and scan repositories and packages for anomalies.
- Inventory AI applications, model endpoints, API keys, service accounts, and compute resources; restrict access and monitor abnormal LLM usage and cost spikes.
- Protect traveling employees' devices with full-disk encryption and pre-boot authentication, BIOS/UEFI passwords, USB controls, and continuous physical custody; avoid carrying sensitive research or strategic information.
MITRE ATT&CK
T1033 · System Owner/User DiscoverySystem Owner/User Discovery was among the top three techniques observed during the reporting period.T1036 · MasqueradingAdversaries disguised implants as legitimate utilities and infrastructure binaries; an LLMJacking actor also named a federated session console-session to resemble a legitimate login.T1059 · Command and Scripting InterpreterCommand and Scripting Interpreter was among the most frequently observed techniques; adversaries used native interpreters to execute malicious commands.T1068 · Exploitation for Privilege EscalationUMBRAL BISON exploited CopyFail at a Ukrainian government entity to escalate privileges to root.T1070.004 · File DeletionVAULT PANDA deleted files to evade detection; a separate cryptomining intrusion deleted its payload staging directory after execution.T1078.004 · Cloud AccountsAdversaries used compromised cloud identities, access keys, and SaaS accounts for resource hijacking, LLM abuse, and data theft.T1098.005 · Device RegistrationCORDIAL SPIDER and SNARKY SPIDER registered attacker-controlled MFA devices to maintain access to compromised identities.T1105 · Ingress Tool TransferReact2Shell post-exploitation activity included curl and wget downloads of tooling and malware, including the GoneDoor implant.T1190 · Exploit Public-Facing ApplicationVAULT PANDA and GENESIS PANDA exploited React2Shell for unauthenticated remote code execution in exposed applications.T1195.002 · Compromise Software Supply ChainALTERED SPIDER and STARDUST CHOLLIMA distributed malicious code through compromised software packages and trusted CI/CD components.T1496 · Resource HijackingFinancially motivated actors hijacked cloud compute resources for cryptocurrency mining and abused corporate LLM access.T1530 · Data from Cloud StorageCORDIAL SPIDER and SNARKY SPIDER collected and downloaded sensitive files from compromised Microsoft 365 and Google Workspace accounts.T1552.005 · Cloud Instance Metadata APISLIM SPIDER queried cloud instance metadata using custom Bash scripts and raw socket connections to obtain temporary cloud credentials.T1557 · Adversary-in-the-MiddleCORDIAL SPIDER and SNARKY SPIDER used SSO-themed adversary-in-the-middle pages to capture credentials and MFA codes during vishing calls.T1574.001 · DLLOVERCAST PANDA executed the FlowCloud loader through DLL search-order hijacking after physically installing implant components.
CVE
CVE-2025-55182React2Shell (CVE-2025-55182) is a critical insecure deserialization vulnerability that enables unauthenticated RCE in React Server Components and Next.js applications. Rapid exploitation of this flaw clearly illustratesCVE-2026-31431publicly disclosed that same day, dubbed CopyFail (CVE-2026-31431). At the time of disclosure, CopyFail was addressedCVE-2026-46300Fragnesia (CVE-2026-46300), were allegedly discovered using AI or AI-assisted research, and threat actors wasted no
Threat Actors
ALTERED SPIDERFinancially motivated adversary responsible for software supply chain compromises, including trivy-action tag poisoning and TeamPCPCloudStealer deployment; compromised more than 300 dependencies in one day during May 2026 operations.Cordial SpiderData theft and extortion adversary using vishing, SSO-themed AiTM pages, MFA device enrollment, and likely custom Python tooling to exfiltrate SaaS data.Cozy BearRussia-nexus adversary abusing OAuth device and authorization code flows to compromise Entra ID accounts and collect email; targeted a U.K.-based think tank in April 2026.Genesis PandaChina-nexus adversary that rapidly exploited React2Shell, deployed VShell and SempathyRAT, and used FScan and a custom script for reconnaissance and cloud credential harvesting.OVERCAST PANDAChina-nexus adversary conducting close access operations against travelers in China, physically installing FlowCloud on unattended devices.SLIM SPIDERBrazil-based eCrime adversary observed targeting cryptocurrency assets and instant payment accounts at a Brazil-based financial institution through cloud credential theft and multi-stage intrusion activity.SNARKY SPIDERData theft and extortion adversary using vishing and compromised SSO identities; used the Genymobile Android emulator for MFA persistence and reached data exfiltration in under five minutes in one incident.STARDUST CHOLLIMADPRK-nexus adversary linked to malicious dYdX libraries, the Axios npm compromise, and compromised Mastra packages delivering PricePilot, ZshBucket, and TeaBundle.UMBRAL BISONBelarus-nexus adversary observed exploiting CopyFail at a Ukrainian government entity just over 20 hours after disclosure, then deploying a Mythic C2 Poseidon agent.VAULT PANDAChina-nexus adversary that exploited React2Shell within 24 hours of public disclosure to deploy GoneDoor.Void DokkaebiDPRK-associated adversary conducting IT worker infiltration and a January–February 2026 supply chain operation using trojanized repositories and an AI-centric IDE against cryptocurrency and blockchain companies.
Malware
CipherForceand their collaborators. These operations included CipherForce ransomwareFlowCloudin which OVERCAST PANDA deployed their proprietary FlowCloud backdoor on victims' devices through direct physicalGoneDoorVAULT PANDA leveraged React2Shell to deploy its GoneDoor implant, disguised as a legitimate Linux utility.PricePilotexchange to deliver the PricePilot malware, likely using credentials stolen from theSempathyRATConcurrently, GENESIS PANDA exploited React2Shell to deploy other tooling alongside two RATs, VShell and SempathyRAT, at multiple victims across several sectors and regions.TeaBundleTeaBundle malware.TeamPCPCloudStealerALTERED SPIDER deployed the self-propagating malware TeamPCPCloudStealer,VshellConcurrently, GENESIS PANDA exploited React2Shell to deploy other tooling alongside two RATs, VShell and SempathyRAT, at multiple victims across several sectors and regions.ZshBucketthe Axios npm package,5 delivering platform-specific variants of their ZshBucket malware.
Vendors
CrowdStrike# CROWDSTRIKE 2026 THREAT HUNTING REPORTGitHub[^1]: npm is a package manager for the JavaScript runtime environment Node.js, with its public registry operated by GitHub.Googlekeys, Azure credentials, Google Cloud tokens, Kubernetes service account tokens, SSHMicrosofttools like Microsoft Quick Assist, adversaries achieve access without executing
Products
Azure DevOpslegitimate tooling. They then pivoted to Azure DevOps, likely using compromised credentials to execute maliciousCrowdStrike Falcon Adversary OverWatchThe CrowdStrike OverWatch team applies this intelligence through proactive threat hunting across customer telemetry to detect and address malicious activity, leveraging AI to hunt at a scale manual investigation cannotCrowdStrike Falcon platform- [CrowdStrike Falcon Platform, Products, and Services](#crowdstrike-falcon-platform-products-and-services)Entra IDcloud control plane activity (including Entra ID sign-ins, device registrations, and application access patterns) whichFalcon Exposure ManagementFalcon Exposure Management addresses the front end of this challenge, deliveringGoogle Workspace365 and Google Workspace. While SNARKY SPIDER manually downloads filesLinuxVAULT PANDA leveraged React2Shell to deploy its GoneDoor implant, disguised as a legitimate Linux utility.Microsoft 365 Apps for EnterpriseMicrosoft 365 Programmatic using a likelyNext.jsinsecure deserialization vulnerability that enables unauthenticated RCE in React Server Components and Next.js applications. Rapid exploitation of this flaw clearly illustrates the compressed window betweenReact Server Componentsis a critical insecure deserialization vulnerability that enables unauthenticated RCE in React Server Components and Next.js applications. Rapid exploitation of this flaw clearly illustrates the compressed
Tools
Burp SuiteGENESIS PANDA Burp SuitecastFollowing exfiltration of digital asset custody secrets, SLIM SPIDER invoked cast, a component of the Foundry EthereumEvilTokensphishing-as-a-service (PhaaS) offerings, most notably EvilTokens and Kali365,fscanAt least one intrusion was intended to extend beyond initial access to the cloud; specifically, GENESIS PANDA downloaded FScan, a publicly available scanning tool, for network enumeration.Kali365phishing-as-a-service (PhaaS) offerings, most notably EvilTokens and Kali365,Mythic C2escalated access, UMBRAL BISON deployed a Mythic C2 Poseidon command-and-control (C2) agent, which theNEXUS // Scanner• NEXUS // Scanner: An API endpoint-scanning panel that uses Ollama AI to sort endpoints intoPainel de Emails Entra ID• Painel de Emails Entra ID: An email reconnaissance panel that searches compromised Microsoft 365Painel Pix• Painel Pix: A transaction panel specifically designed to execute bulk unauthorized Pix transfers fromTruffleHogReverse shells Trufflehog
Countries
Belarus- **BISON**: BELARUSBrazilintrusion at a Brazil-based financial institution, targeting the organization's cryptocurrency assets and instantChinaChina-nexus adversaries moved even faster, with VAULT PANDA and GENESIS PANDA launching deliberate attacks within 24 hours of public disclosure of a critical web application vulnerability.DPRKFAMOUS CHOLLIMA, associated with the Democratic People’s Republic of Korea (DPRK), weaponized trusted AI-centric development environments to compromise cryptocurrency and blockchain companies.Japan| | Japan | United States | | |Russia- **BEAR**: RUSSIATaiwan| | Taiwan | United Kingdom | | |United Kingdom| | Taiwan | United Kingdom | | |United States| | Japan | United States | | |
Industries
AcademicThe two most notable exceptions were the financial services and academic sectors, which recorded the largest increases of any sector at 11% and 17%, respectively, signaling that adversaries are increasingly targetingAgriculture| | Agriculture | Legal | NGO or Nonprofit | |Biotechnologybelonging to employees of a U.S.-based agricultural biotechnology company attending a major industry conferenceconsulting and professional servicesNation-state threat actors prioritize technology, financial services, and government entities, while eCrime adversaries concentrate on technology, consulting and professional services, and manufacturing entities.Energy| | Energy | Logistics | Technology | |Financial ServicesNation-state threat actors prioritize technology, financial services, and government entities, while eCrime adversaries concentrate on technology, consulting and professional services, and manufacturing entities.GovernmentNation-state threat actors prioritize technology, financial services, and government entities, while eCrime adversaries concentrate on technology, consulting and professional services, and manufacturing entities.ManufacturingNation-state threat actors prioritize technology, financial services, and government entities, while eCrime adversaries concentrate on technology, consulting and professional services, and manufacturing entities.Media| | Hospitality | Media | Utilities | |TechnologyTechnology remains the most targeted sector for the ninth consecutive year, a distinction that speaks to the high-value data and critical infrastructure it represents.