Menu
SUBSCRIBE
SUBSCRIBE
Menu

CrowdStrike

Red and black illustration of a masked attacker for an article about online attack guides and software flaws.

Online Attack Guides Leave Companies Less Than 48 Hours to Fix Software Flaws

, , , , , , , , ,

CrowdStrike found attackers began using the flaws within two days in 88% of the cases it observed.

 

Key Takeaways

  • 88% of the attacks CrowdStrike observed involving publicly available instructions for exploiting software flaws began within 48 hours of their release.
  • China-linked attackers exploited a critical web application flaw within 24 hours of its public disclosure.
  • AI agents generated potential attacks at 2.5 times the rate of humans during the reporting period.

Cybersecurity company CrowdStrike released its 2026 Threat Hunting Report, finding attackers began exploiting software flaws within 48 hours of working attack instructions becoming public in 88% of the cases it observed during the first half of 2026.

Companies may have less than two days to patch a weakness after researchers publicly demonstrate how it can be attacked. CrowdStrike said the window between disclosure and widespread exploitation is now measured in hours rather than days.

AI is accelerating attacks using working attack instructions

Researchers sometimes publish code or technical instructions showing that a newly disclosed software flaw can be exploited. These demonstrations are known as proofs of concept.

CrowdStrike found that once instructions for attacking a software flaw appeared online, attacks followed within 48 hours in 88% of the cases it observed.

AI is speeding up the work that leads to those attacks. CrowdStrike said researchers and attackers can use AI to find software flaws and develop working attacks more quickly.

For example, a critical flaw affecting React and Next.js applications was publicly disclosed with patches on Dec. 3, 2025. Within 24 hours, working attack instructions were circulating online. Criminals, state-backed hackers, and unidentified attackers had begun using the flaw. During the first four days after the React and Next.js flaw was disclosed, CrowdStrike investigated more than 800 possible attacks affecting more than 80 victims. 

In a separate case, researchers released instructions for exploiting a Linux flaw on April 29. CrowdStrike detected a Belarus-linked attacker using the instructions against a Ukrainian government organization just over 20 hours later.

CrowdStrike expects more capable AI systems to reduce the time between finding a software flaw and attacking it, leaving companies even less time to install security fixes.

AI agents generate more potential attacks

CrowdStrike also found AI agents generated potential attacks at 2.5 times the rate of humans during the 12 months ending June 30.

The company described the activity as “detection leads,” meaning possible attacks that required investigation.

The report did not disclose the underlying number of potential attacks or how many were confirmed as malicious.

CrowdStrike’s earlier 2026 Global Threat Report recorded an 89% increase in attacker activity involving AI during 2025. The latest report also documents attackers using generative AI to create malicious commands and software, stealing access to corporate AI models and exploiting weaknesses in AI server software.

CrowdStrike expects AI-assisted security research to continue shortening the time companies have to address newly disclosed software flaws.

Red illustration of an armored adversary figure with an animal skull face and wide hat, hackers use AI against tech companies

Hackers Now Use AI To Break In, Get Hired, And Bait Victims, CrowdStrike Reports

, , , , , , , , , ,

The most active criminal group attacking technology companies grew its intrusions by more than 120% in a year, with AI-generated scripts in its toolkit.

 

Key Takeaways

  • PUNK SPIDER, the criminal group with the most break-ins at technology companies, uses AI-generated scripts to steal passwords and likely DeepSeek-built scripts to destroy forensic evidence. Its activity rose more than 120% in a year.
  • FAMOUS CHOLLIMA, a North Korean state group, used AI to help fake IT workers get hired at tech companies and send their salaries home to the regime. It accounted for 47% of all state-backed break-ins against the sector.
  • Criminals spread a new Mac password stealer in early 2026 through fake add-ons for OpenClaw and fake download sites for legitimate AI tools.
  • Chinese state hackers hit tech more than any other sector. CrowdStrike assesses AI is a top theft target for Beijing, which has stated it intends to lead the world in AI by 2030.
  • Iran’s Revolutionary Guard threatened the Middle East locations of 18 US technology and AI companies on March 31.

 

CrowdStrike published its 2026 Technology Threat Landscape Report in early June, covering the 12 months ending March 31, 2026. The report tracks break-ins at technology companies worldwide, the most attacked industry for several years running. A pattern runs through it: hackers use AI at almost every stage of their attacks.

 

AI as a break-in tool

PUNK SPIDER, the criminal group that broke into more technology companies than any other during the period, uses AI-generated scripts to harvest passwords from compromised systems. CrowdStrike says the group likely also uses scripts built with DeepSeek, the Chinese AI model, to shut down a victim’s databases and destroy the evidence investigators would need afterward. The group’s attack volume grew by more than 120% in a year.

North Korea’s FAMOUS CHOLLIMA uses AI to get its programmers hired into remote jobs at technology companies, many of them in the US, not for espionage, but for profit. The workers, stationed abroad, apply using stolen or invented American identities, and AI helps them pass screening and interviews. Once a worker is hired, the company ships a laptop to a paid accomplice in the US, who keeps the machine online so the worker can operate it remotely and appear to be in the US. The salaries go to the North Korean government. The group accounted for 47% of all state-backed break-ins at tech companies, and some of its workers have also stolen data from employers.

In June 2025, the Justice Department searched 29 homes and offices across 16 states where these laptops were located. Prosecutors said the scheme reached more than 100 US companies. The Department of the Treasury has sanctioned middlemen who converted the wages, including more than $600,000 in cryptocurrency, for a North Korean IT firm tied to the country’s defense ministry. The department says the money supports North Korea’s weapons programs.

 

AI as bait

Criminals also used the AI boom itself as a lure. In February 2026, criminals built fake add-ons for the AI tool OpenClaw. Victims who ran the one-line installation command got Skrawl, a new password stealer for Mac computers, instead of the add-on. In March, criminals delivered the same program through fake download sites for legitimate AI tools.

 

AI as the prize

For state-backed hackers, AI is also something to steal. Chinese state hackers targeted technology companies more frequently than any other sector, and CrowdStrike assesses that AI is a particularly high-value target for theft for Beijing, which has stated it intends to lead the world in AI by 2030.

Beijing’s pursuit of US AI extends beyond hacking. In April, the State Department warned allied governments that Chinese AI firms were replicating leading US models through distillation, in which one AI system learns by analyzing another’s outputs. A White House memo called the efforts “industrial-scale.”

Iran has threatened AI companies directly. On March 31, its Revolutionary Guard threatened retaliation against the Middle East locations of 18 US technology and AI companies if targeted killings of its leadership continued.

 

Trend line

The most targeted industry is technology, accounting for 20% of all break-ins in Q1 2026. That is 26% higher than the second-most-targeted sector, consulting and professional services. CrowdStrike expects AI to accelerate the problem as attackers improve the sophistication, scale, and speed of their attacks, shrinking the time defenders have to identify and stop them.