CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates

CrowdStrike's 2026 Threat Hunting Report documents a shift toward trust-abuse attacks where adversaries — including DPRK-, China-, and Belarus-nexus groups — exploit AI systems, developer ecosystems, cloud and SaaS identity flows, and package registries to rapidly gain access and steal data; notable findings include mass LLMJacking (≈200k API requests in 2 minutes), rapid exploitation of public PoCs (88% within 48 hours, many within 24), and large-scale npm supply-chain compromises affecting dozens to hundreds of dependencies.