1. Executive summary
Microsoft's 2026 Digital Defense Report, covering July 2025 to June 2026, describes a period in which attackers are collecting the benefits of AI before defenders close the gap. The report states that the median time from in-the-wild vulnerability discovery to weaponization has fallen to well below 24 hours, that phishing accounted for 23% of the intrusions Microsoft's incident responders investigated (up from 7% a year earlier), and that exploitation of public-facing applications rose from 15% to 24% over the same period. No CVE, product version or affected customer set is named in the source material, so this advisory carries no patch action and no verified severity rating. The bottom-line risk to EMEA financial services is a shrinking window between public vulnerability disclosure and exploitation, which compresses the time your patch and detection functions have to react, and a phishing and identity-fraud problem that AI has made cheaper to run at scale.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The item is a vendor trend report. It names no incident at a specific entity, no exploited product, and no third party in a client's supply chain, so no reporting or testing obligation is triggered by the facts as published. The report's finding on compressed weaponization timelines is relevant to how you schedule DORA Art. 24 resilience testing and how you scope NIS2 Art. 21(2)(d) supply chain measures, but the item itself does not engage those articles.
3. Technical analysis & attack chain
This is a strategic trend item, not a vulnerability or campaign report. There is no confirmed attack chain to reproduce. What follows is how the report describes attacker behaviour, and what it does and does not establish.
Microsoft's central claim is that vulnerability discovery and weaponization, which once required human specialists, now in many cases comes down to writing a prompt. The report puts the median time from in-the-wild discovery to weaponization at well below 24 hours. It projects roughly 72,000 CVEs tracked for 2026, a record, and expects remediation to lag discovery, producing a multi-year period in which known unpatched vulnerabilities accumulate. Microsoft states that well-funded attackers may be able to stockpile zero-days found this way. That stockpiling claim is an expectation, not an observation, and the report gives no evidence of a specific stockpile.
Initial access shifted over the reporting period. Phishing was the entry vector in 23% of the intrusions Microsoft's responders investigated between July 2025 and June 2026, up from 7% the prior year. Exploitation of public-facing applications rose from 15% to 24%. The report does not break these figures down by sector or region, so the EMEA financial services share is unknown.
On identity, the report states that in 52.2% of intrusions that began with valid accounts, attackers harvested further credentials once inside, and a further 18.4% involved active password spray campaigns. This is the most operationally useful number in the report for a bank: once an attacker is in with a working account, credential harvesting inside the estate is the norm, not the exception.
The report attributes AI use to state actors. It says some Chinese state actors use AI tools to search for vulnerabilities or for guidance on exploiting them. It says Russian actors have used vibe coding and AI-generated tooling, with AI increasing the scale and speed of their operations. It says North Korean actors have increased AI use, with the remote IT worker scheme using AI for persona development, social engineering and maintaining access, and other North Korean groups using it for malware creation and infrastructure management, including agentic workflows and LLM-generated code. The report lists the March 2026 compromise of the Axios npm package by a state-sponsored group among North Korean supply chain activity. These are vendor attributions. No MITRE ATT&CK group profile is available for any of the actors named, so treat each attribution as unconfirmed and single-sourced to Microsoft.
Three malware cases in the report show AI in the payload itself. The s1ngularity malware, distributed through trojanized Nx npm packages in August 2025, searched infected machines for Claude Code, Gemini CLI or Amazon Q CLI, ran them with permissive overrides, and used them to hunt for secrets and SSH keys. Microsoft attributes roughly 2,000 leaked secrets and about 20,000 files from 225 victims to that operation. PromptLock, described as an experimental ransomware prototype, shipped with prompts only and received Lua scripts at runtime from an open-weights model hosted on attacker infrastructure. In December 2025, Microsoft found a malicious browser extension with more than 600,000 installs harvesting ChatGPT and DeepSeek conversations; it affected almost 10,000 organisations before mitigation. The report gives no extension name, ID, store listing or hash for that extension, which limits hunting to behaviour rather than atomic indicators.
On autonomy, the report states that Anthropic's Mythos and OpenAI's GPT-5.5 were the first models to show potential to orchestrate complex attacks unaided. In a test against an emulated enterprise environment with no defenders, they took control of the whole domain, including the main server and all user accounts, through a 32-step chain. The report says open-weight models trail closed models in attack orchestration by seven months. It also references the first documented automated ransomware extortion attack in early July 2026, but the source text is truncated at that point and does not name the victim, the tooling or the extortion mechanism. Do not treat that reference as established detail; it is an incomplete sentence in the source.
Two caveats apply to this whole section. First, the report is a vendor publication and the figures are Microsoft's own incident-response caseload, not a sector-wide census; the phishing and exploitation percentages describe Microsoft's investigations, not the market. Second, the source material available to Adverse Trace is a news summary of the report, not the report itself. Where the summary is thin, this advisory is thin. We have not padded it.
4. Mitigation & containment
The report names no product, version or CVE, so there is no patch action here. The controls below target the two mechanisms the report does quantify: exploitation of public-facing applications and identity-based intrusion.
P1 (within 24h)
- Reconcile your internet-facing inventory against your vulnerability scanner's coverage. The report's 24% exploitation figure is a statement about public-facing applications, and you cannot compress patch time on assets you have not enumerated.
- Confirm that emergency change can be executed inside 24 hours for internet-facing systems. The report's sub-24-hour weaponization median is the deadline your change process has to beat, not the deadline your normal patch cycle meets.
- Review alerting on password spray against your identity provider. The report puts 18.4% of valid-account intrusions on active spray campaigns; if you have no spray-specific detection, that is the gap to close first.
P2 (within 72h)
- Audit service accounts and non-human identities for standing privilege. The report's 52.2% internal credential-harvesting figure means an account that can read credential stores is a lateral-movement path, not a convenience.
- Check endpoint and CI/CD telemetry for developer-tool execution outside normal developer workflows. The s1ngularity case turned on invoking Claude Code, Gemini CLI and Amazon Q CLI with permissive overrides on machines that should not have been running them interactively. If your build runners or developer laptops run these CLIs, alert on invocations with override flags and on outbound connections from those processes to unexpected destinations.
- Inventory browser extensions across managed browsers and remove anything not on an approved list. The December 2025 extension reached more than 600,000 installs; extension-level data access bypasses a lot of endpoint control.
P3 (within 7 days)
- Add a control that blocks or alerts on npm package installation from non-approved registries or on unexpected post-install scripts in build pipelines, given the Axios and Nx npm supply chain cases in the report.
- Test your detection coverage against a credential-harvesting scenario that starts from a single valid account, since that is the pattern the report describes most concretely.
- Review DORA Art. 24 testing scope against the report's finding that exploitation of public-facing applications is rising; if your scenario library does not include a public-facing application compromise, add one.
5. Indicators of compromise
No indicators of compromise available in the source material. The report names no hashes, domains, IP addresses, file paths, registry keys or command lines. The s1ngularity, PromptLock and browser-extension cases are described by capability and outcome only.
The sources do describe observable behaviours. Those are listed below and are not machine-pivotable atomic indicators, so they are not reproduced in a copyable block.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Claude Code, Gemini CLI or Amazon Q CLI executed with permissive overrides on a host, followed by reads of secret stores and SSH key material | endpoint process telemetry, EDR, CI/CD runner logs | single-sourced to Microsoft; verify before enforcement |
| npm package installs pulling trojanized packages (Nx, Axios named in the report) with post-install execution | build pipeline logs, package manager audit logs, registry proxy logs | single-sourced to Microsoft; verify before enforcement |
| Browser extension with broad conversation and page access installed at scale across managed browsers | browser extension inventory, MDM/endpoint management reporting | single-sourced to Microsoft; verify before enforcement |
| Password spray against identity provider followed by credential harvesting from the compromised account | IdP sign-in logs, directory service logs, credential store access events | single-sourced to Microsoft; verify before enforcement |
6. Detection
Insufficient indicators to author detection rules. The source material provides no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values. The named tools (Claude Code, Gemini CLI, Amazon Q CLI) are legitimate developer products, and a rule matching their names would detect normal developer activity rather than the s1ngularity behaviour. The report gives no extension identifier, no npm package version and no PromptLock artefact. Authoring a rule from this material would produce false positives against legitimate tooling and would not detect the threat.
7. Sources
- Help Net Security, "AI is giving attackers a head start, Microsoft warns", https://www.helpnetsecurity.com/2026/10/02/ai-cybersecurity-threats-microsoft-report/, 2026-10-02. This is the only source available to Adverse Trace for this advisory. It summarises Microsoft's 2026 Digital Defense Report (covering July 2025 to June 2026); the underlying report was not retrieved. All figures, attributions and case details in this advisory trace to this single item.
8. Adverse Trace position
We assess this as a strategic trend item with no direct action for a specific client estate, and we are not assigning it a severity rating because there is no vulnerability, no exploited product and no affected customer set to rate. The report's numbers are Microsoft's own incident-response caseload, not a sector census, and the source available to us is a news summary rather than the report, so the figures should be read as directional. The one finding we would act on now is the sub-24-hour weaponization median combined with the rise in public-facing application exploitation: that is a statement about how fast your emergency change and detection functions need to move, and it is testable against your own patch and alerting timelines. The state-actor attributions are single-sourced to Microsoft and no MITRE ATT&CK profile is available for the named actors, so we treat them as unconfirmed. We will retrieve the full Microsoft Digital Defense Report and reissue this advisory if it contains sector-specific data, named CVEs or atomic indicators that the summary omits. Clients who want to test the identity findings against their own telemetry should contact their Adverse Trace handler to scope a credential-harvesting detection review.
Published via PulseTrace — Adverse Trace threat intelligence.