Blog

For years, the cybersecurity industry described AI as a tool that attackers might one day use to accelerate their campaigns. That future arrived in 2026 and it arrived faster and more completely than most threat models anticipated.

CrowdStrike’s 2026 Global Threat Report documents an 89% year-over-year surge in AI-enabled adversarial activity. New malware families like PROMPTFLUX, PROMPTSTEAL, and PROMPTLOCK don’t just use AI to choose their targets or craft phishing emails. They embed large language models directly into their execution runtime, generating obfuscated exploit code on demand, adapting to the specific environment they’re operating in, and producing new attack variants that have never existed in any threat database before.

This is the inflection point the industry has been warning about. The question is whether your defense architecture was built for it.

What Is AI-Powered Cyberattack Capability in 2026?

AI-powered cyberattacks in 2026 go far beyond automated phishing. The term now describes attacks where AI actively participates in offensive decision-making: selecting targets, generating payloads, adapting to defensive responses, and evading detection in real time. Three tiers of capability are now in active use:

Tier 1: AI-assisted attacks — Human operators use AI to accelerate specific tasks (phishing content generation, code reuse, target profiling). This was the dominant model in 2024-2025.

Tier 2: AI-augmented attacks — AI handles entire phases of the attack chain autonomously while humans supervise. Reconnaissance, initial payload generation, and vulnerability matching now run at machine speed.

Tier 3: Agentic AI attacks — The malware itself contains an AI model that makes operational decisions without human input. PROMPTFLUX, PROMPTSTEAL, and PROMPTLOCK represent this tier. They are not AI-assisted; they are AI-led.

The Malware Families Rewriting the Rules

Three newly documented malware families define the 2026 threat landscape:

PROMPTFLUX generates entirely novel obfuscated code at runtime. Each execution produces unique code that has never existed before, bypassing signature-based and hash-based detection entirely. There is no static indicator of compromise to match against.

PROMPTSTEAL uses embedded LLM capability to understand the context of the environment it has accessed, identifying high-value credentials, sensitive documents, and communication patterns, and exfiltrates with surgical precision rather than bulk extraction.

PROMPTLOCK is a ransomware variant that generates unique encryption implementations per target, making decryptor development impractical. It also uses LLM analysis to identify the most operationally damaging files to encrypt first.

The precursors to these families are already documented: MalTerminal, the earliest known GPT-4-powered malware generating ransomware and reverse-shell code at runtime. LAMEHUG, which uses live LLM interactions to generate system commands on demand rather than using a fixed command set.

The Speed Advantage Has Shifted

The 89% increase in AI-enabled attacks is not just a volume story. It’s a speed story. AI can analyze newly published patches the moment they’re released and generate working exploit code in minutes. 61% of new CVEs are now weaponized within 48 hours of disclosure. The time-to-exploit window with AI assistance has compressed to a single day for high-value vulnerabilities.

Defense teams operating on weekly patching cycles or manual triage workflows are structurally misaligned with this tempo.

The Defense Paradigm That No Longer Works

The legacy defense model was built on a core assumption: that known-bad indicators, file hashes, IP addresses, domain names, YARA signatures, could be collected, shared, and used to block attacks before they succeeded.

This model worked when attackers reused tools, infrastructure, and code across campaigns. It fails when:

• Each payload is unique and generated on demand
• C2 infrastructure rotates faster than threat intelligence feeds update
• Exploitation occurs within hours of vulnerability disclosure
• The malware itself adapts to the detection environment it encounters

Signature-based detection, static vulnerability scanning, and human-speed triage are not wrong, they remain necessary, but they are no longer sufficient as the primary defensive layer.

What Happens When Teams Don’t Adapt

Only Autonomous, Agentic AI Defense Can Match Autonomous, Agentic Offense

The industry’s response to AI-led attacks cannot be faster humans. It has to be autonomous AI defense: systems that detect, analyze, and respond at machine speed, without waiting for an analyst to click approve.

This is the core design principle behind BrahmaFusion, Peris.ai’s agentic AI and hyperautomation platform. BrahmaFusion does not wait for a human to review an alert. It ingests telemetry from EDR, XDR, NVM, and external threat intelligence simultaneously, identifies behavioral patterns that indicate AI-generated attack activity, including runtime code generation, anomalous API call sequences, and unusual LLM-style query patterns, and executes containment workflows automatically.

INDRA CTI provides real-time threat actor attribution and campaign tracking. When a new AI-enabled malware family is documented, INDRA CTI maps its behavioral indicators to your environment’s telemetry and surfaces exposure within minutes, not days.

Our XDR and EDR provide the multi-layer telemetry that BrahmaFusion’s AI operates on. Behavioral baselines established over time allow anomaly detection that doesn’t depend on known-bad signatures, exactly what’s needed against PROMPTFLUX-style polymorphic payloads.

A leading financial startup using BrahmaFusion achieved 40% SOC cost savings while simultaneously improving detection coverage. The platform reduced analyst workload by 35% by automating triage, enrichment, and containment for the majority of alerts, freeing human analysts to focus on the cases that genuinely require human judgment.

Real-World Scenario: Detecting PROMPTFLUX in a Financial Environment

• T+0:00 — A finance employee opens a phishing PDF; PROMPTFLUX is dropped and begins LLM-based environment analysis
• T+0:04 — EDR detects anomalous API call sequences inconsistent with any known malware family
• T+0:05 — BrahmaFusion correlates the API pattern with behavioral indicators from INDRA CTI’s LLM malware taxonomy
• T+0:07 — The host is automatically isolated; PROMPTFLUX’s exfiltration attempt fails
• T+0:09 — An IRP case is created with full behavioral trace, MITRE ATT&CK mapping (T1059, T1027), and automated remediation steps
• T+2:15 — Analyst reviews case, confirms containment, and approves host restoration

Total analyst involvement: 4 minutes of review. Total attack window: under 10 minutes, zero exfiltration.

Benefits of Agentic AI Defense Against AI-Led Attacks

Conclusion

The 89% surge in AI-enabled attacks documented by CrowdStrike in 2026 is not a trend line to monitor. It’s a structural shift in the threat landscape that has already outpaced the legacy defense model’s ability to respond. PROMPTFLUX, PROMPTSTEAL, and PROMPTLOCK are not hypothetical. They are in active deployment against organizations that have not yet updated their defense architecture for the era of autonomous AI offense.

Peris.ai was built for this moment. BrahmaFusion’s agentic AI, INDRA CTI’s real-time intelligence, and our XDR and EDR telemetry layers are specifically designed to meet autonomous attacks with autonomous defense. Learn more about how Peris.ai protects organizations at machine speed: visit Peris.ai.

FAQ

What are AI-powered cyberattacks?

AI-powered cyberattacks use artificial intelligence to automate or enhance offensive capabilities, including payload generation, target selection, evasion adaptation, and autonomous decision-making during an intrusion. In 2026, the most advanced variants embed LLMs directly into malware execution runtimes.

What is PROMPTFLUX malware?

PROMPTFLUX is a malware family that uses an embedded LLM to generate unique, obfuscated exploit code at runtime on every execution. Because each instance is unique, traditional signature-based detection cannot identify it.

How fast are AI-generated exploits developed?

With AI assistance, working exploits can be developed within minutes of a patch release. 61% of newly disclosed CVEs are weaponized within 48 hours, and some high-value vulnerabilities are exploited within a single day of public disclosure.

How does agentic AI defense work?

Agentic AI defense uses autonomous AI systems to ingest multi-source telemetry, detect behavioral anomalies that indicate attacks, and execute containment workflows automatically, without waiting for human approval. Platforms like BrahmaFusion by Peris.ai operate at machine speed to match the tempo of AI-led attacks.

What is the difference between AI-assisted and agentic AI attacks?

AI-assisted attacks use AI to speed up specific human-directed tasks. Agentic AI attacks embed AI into the malware itself, allowing it to make operational decisions autonomously during an intrusion, selecting targets, generating payloads, and adapting to defenses without human input.

Deepfake voice fraud drained $1.1 billion from US corporate accounts in 2025. In 2026, the attacks are faster, cheaper, and more convincing than ever. Here is how they work, and what finance and security leaders need to do about it.

The call sounded exactly like the CFO. The voice, the cadence, even the slight impatience in the tone. The wire transfer instruction was specific, urgent, and entirely plausible. The finance associate on the other end of the call had no reason to question it.

That call was a fraud. The CFO never made it. A criminal did, using a voice cloned from three seconds of publicly available audio.

Deepfake CEO fraud, also called vishing executive impersonation, is the fastest-growing financial crime targeting enterprises in 2026. This post explains how it works, what the data says, and how organisations can defend against it before the next fraudulent wire instruction lands in their inbox.

What Is Deepfake CEO Fraud?

Deepfake CEO fraud is a form of business email compromise (BEC) evolved to the voice channel. Attackers use AI voice synthesis tools to clone the voice of a senior executive, then use the synthetic voice in real-time phone calls or audio messages to authorise fraudulent wire transfers, request credential resets, or instruct employees to bypass security controls. The attack exploits the inherent trust that employees place in the voices of their leadership.

The Scale of the Problem: $1.1 Billion and Rising

The numbers attached to deepfake voice fraud in 2025 and 2026 are not projections. They are documented losses:

• Deepfake voice attacks drained $1.1 billion from US corporate accounts in 2025, tripling the prior year’s figure of $360 million
• 243% surge in deepfake voice attacks over the past year
• Average loss per deepfake vishing case: approximately $600,000
• 10% or more of financial institutions have suffered deepfake vishing attacks exceeding $1 million per incident
• Deloitte projects the trajectory of deepfake fraud losses reaching $40 billion in the coming years
• A Swiss businessman was defrauded of several million Swiss francs via voice cloning in January 2026

The technology enabling these attacks is not expensive or restricted. A convincing voice clone can now be generated from as little as three seconds of audio. Every earnings call, conference keynote, podcast interview, and media appearance that a finance executive has ever recorded is raw training data for criminals.

How Attackers Execute a Deepfake Voice Fraud

Step 1: Target Selection and Audio Harvesting

Attackers identify a target organisation and select an executive whose voice is publicly available. CFOs, CEOs, and General Counsels are the most common targets because they have authority to authorise financial transactions. Public audio sources include YouTube interviews, investor calls, conference recordings, and podcasts.

Step 2: Voice Synthesis

Using commercial or criminal AI voice tools, attackers generate a synthetic voice model capable of producing real-time speech in the target’s voice. Criminal AI toolkits purpose-built for fraud, including tools tracked by INDRA CTI, have removed the technical barriers that previously required specialist knowledge.

Step 3: The Call

The attacker calls a finance associate, accounts payable team member, or IT help desk. The synthetic voice delivers an urgent instruction: a wire transfer to a new account, an emergency credential reset, or a request to bypass normal approval workflows due to time pressure. The social engineering is often reinforced by a follow-up email from a spoofed or compromised address.

Step 4: Covering Tracks

Once the transfer is made or credentials are compromised, the attacker moves quickly. Funds are often through multiple accounts within hours. By the time the real executive is informed, recovery is typically impossible.

What Happens When Organisations Are Unprepared?

Organisations without voice verification protocols and deepfake detection capabilities face several compounding risks:

• Finance teams have no way to distinguish a legitimate executive call from a synthetic one in real time
• Standard callback verification can be defeated if the attacker has also compromised the executive’s phone number or email
• HR teams receive fraudulent payroll diversion requests using the same technique
• Reputational damage extends beyond the financial loss, particularly for publicly listed companies

Before vs. After: Deepfake Defence Maturity

How Peris.ai Protects Against Deepfake Executive Fraud

INDRA CTI monitors the criminal AI toolkit ecosystem, including voice synthesis tools and the marketplaces where they are sold and leased. When new deepfake voice fraud toolkits targeting finance executives are identified, INDRA CTI surfaces intelligence on their capabilities, infrastructure, and indicators of compromise to your security team before your organisation becomes a target.

BrahmaFusion, Peris.ai’s agentic AI and hyperautomation platform, can be configured to detect the specific combination of signals that precede a deepfake vishing attack: anomalous wire transfer requests in email chains that reference a phone call as authorisation, executive name mentions combined with financial transaction keywords, and unusual patterns in help desk credential reset requests. When these signals appear together, BrahmaFusion triggers automated review workflows before a transfer is approved.

Peris.ai IRP provides the incident response framework for organisations that have already been targeted. When a deepfake fraud incident is suspected, Peris.ai IRP opens a structured case with a pre-built workflow covering evidence collection, financial institution notification, regulatory reporting requirements, and post-incident controls review.

Scenario: The $2.4 Million Phone Call

A mid-size fintech company receives a call from the CFO’s number at 4:45pm on a Friday. The voice instructs the accounts payable manager to release a $2.4 million payment to a new vendor account before close of business, citing a signed contract that will be emailed shortly.

Without deepfake defence controls, the transfer is approved.

With Peris.ai controls in place:

• BrahmaFusion detects the pattern: Friday afternoon wire request + phone authorisation + new vendor account, and flags it for secondary review
• INDRA CTI confirms that a criminal voice synthesis toolkit has been actively targeting fintech CFOs in the region that week
• The finance manager receives an automated alert requiring out-of-band confirmation via the company’s verified internal messaging system
• The real CFO is contacted. The fraud is stopped. The $2.4 million stays where it belongs.

Benefits at a Glance

Final Thought

Every earnings call your CFO has ever recorded is a training dataset. Every investor presentation is source material. The voice that your finance team trusts most is now replicable from a few seconds of audio, and the tools to do it are available to criminals on underground markets today.

The organisations that survive this threat are not those with better voice recognition. They are those with better processes: verification controls, threat intelligence, and incident response capabilities that assume synthetic voices are a real and present risk.

Platforms like BrahmaFusion by Peris.ai, combined with INDRA CTI’s real-time monitoring of criminal AI toolkits, give lean security teams the intelligence and automation to stop these attacks before the wire goes out. Don’t wait for a breach to take action. Secure your organisation today. Stay Secure with Peris.ai.

Frequently Asked Questions

What is deepfake CEO fraud?

Deepfake CEO fraud is a type of business email compromise attack where criminals use AI voice synthesis to clone an executive’s voice and make fraudulent phone calls authorising wire transfers or credential changes. A convincing voice clone can be created from as little as 3 seconds of publicly available audio.

How much money has been lost to deepfake voice fraud?

Deepfake voice attacks drained $1.1 billion from US corporate accounts in 2025, tripling the prior year’s losses. The average loss per deepfake vishing case is approximately $600,000, and over 10% of financial institutions have suffered attacks exceeding $1 million per incident.

How do attackers clone an executive’s voice?

Attackers harvest publicly available audio from earnings calls, podcasts, conference recordings, and media interviews. Using commercial or criminal AI voice synthesis tools, they generate a real-time voice model. The process requires minimal technical skill and can be completed in hours.

What is the best defence against deepfake voice fraud?

Effective defence combines multi-factor out-of-band verification for financial authorisations, real-time threat intelligence on criminal AI toolkits (such as INDRA CTI), automated detection of anomalous transaction patterns (such as BrahmaFusion), and a prepared incident response workflow for when attacks occur.

How does BrahmaFusion detect deepfake fraud attempts?

BrahmaFusion analyses combinations of signals that correlate with deepfake fraud: wire transfer requests referencing phone authorisations, executive name mentions combined with financial transaction keywords, and unusual help desk credential reset patterns. When these signals appear together, it triggers automated secondary approval workflows before transactions are processed.

The tell-tale sign of a phishing email used to be the grammar. Awkward phrasing, misaligned tone, a CFO who suddenly writes like a non-native speaker, these were the signals security awareness training taught employees to catch.

Those signals are gone.

Generative AI has closed the stylistic gap between a real executive’s writing and a synthetic impersonation. Today, 40% of business email compromise (BEC) phishing emails are AI-generated, producing personalized, contextually accurate messages that match the target executive’s known vocabulary, communication cadence, and organizational context. The click-through rate on AI-crafted lures is 450% higher than on traditional phishing emails. And the financial sector is the primary target.

For CISOs at banks, insurers, and fintech firms, this is not an incremental escalation of a known threat. It is a qualitative change in what BEC actually is.

What Is AI-Powered Business Email Compromise?

Business email compromise (BEC) is a class of fraud where attackers impersonate executives, vendors, or business partners to manipulate employees into transferring funds, divulging credentials, or executing unauthorized transactions. Traditional BEC relied on social engineering and domain spoofing. AI-powered BEC adds stylometric matching, voice cloning, real-time context harvesting from LinkedIn and corporate websites, and automated multi-channel targeting.

The FBI IC3 reported that BEC caused more than $2.7 billion in adjusted losses in 2024 and accounts for 73% of all reported cyber incidents.

How the AI-BEC Threat Has Evolved in 2026

Adversary-in-the-Middle (AiTM) Phishing

In January 2026, Microsoft documented a multi-stage AiTM phishing and BEC campaign targeting the energy sector via SharePoint. Rather than simply spoofing an email, the attacker positioned themselves between the victim and a legitimate Microsoft authentication flow, intercepting session tokens in real time.

Dual-Channel BEC Attacks

The dominant 2026 BEC pattern is the dual-channel attack: simultaneous multi-vector contact where the target receives a spoofed email from an “executive” and a concurrent phone call or SMS confirming the request. The second channel creates urgency and authenticity reinforcement that significantly increases compliance rates.

Callback Phishing

Callback phishing, where a phishing email instructs the target to call a fraudulent number staffed by social engineers posing as IT or finance support, more than doubled in popularity in 2025 and continues accelerating into 2026.

What Happens When Financial Security Teams Don’t Address This

According to 2026 threat intelligence, 59% of financial services organizations hit by ransomware had their data successfully encrypted. The median ransom demand in financial services reached $3 million.

The Financial Sector’s Structural Vulnerability

How Peris.ai Defends Financial Institutions Against AI-BEC

BrahmaFusion: Behavioral Analytics and Anomalous Communication Detection

BrahmaFusion, Peris.ai’s agentic AI and hyperautomation platform, applies behavioral analytics to communication patterns across email, endpoint, and identity systems. While content filtering can be defeated by stylistically accurate AI-generated text, behavioral analytics focuses on what is unusual about how and when a communication occurs: an executive sending a wire transfer request from an unusual IP, at an unusual hour, to a new payee, without the corresponding approval workflow.

A FeedLoop customer using BrahmaFusion’s automation reported a 70% reduction in response time for anomalous communication incidents.

INDRA CTI: Tracking BEC Campaigns Targeting Financial Institutions

INDRA CTI provides real-time intelligence on threat actor campaigns, including BEC operations targeting specific industries and geographies. When a threat actor group begins targeting the Indonesian banking sector with AiTM infrastructure, INDRA CTI surfaces the relevant indicators before the first targeted email reaches your inbox.

Use Case: Catching an AI-BEC Attack Before the Wire Transfers

A regional bank’s CFO receives what appears to be an email from the CEO requesting an urgent $4.2M wire transfer to a new overseas account for a confidential acquisition. The email matches the CEO’s known writing style precisely.

BrahmaFusion flags the transaction request before it reaches the wire desk:

• The email originated from an AiTM proxy domain registered 48 hours earlier (INDRA CTI IOC match)
• The CEO’s actual session shows no corresponding activity in the corporate email system around the email’s timestamp
• The payee account has no prior relationship in the organization’s transaction history
• The request bypassed the standard dual-approval workflow required for transfers above $1M

The BrahmaFusion playbook pauses the request, alerts the SOC and compliance team, and generates a case in Peris.ai IRP with full evidence chain. The attack is neutralized without reaching the wire desk.

Benefits at a Glance

The Authentication Stack Is No Longer Sufficient on Its Own

MFA was the correct response to credential theft. AiTM attacks are the response to MFA. The adversarial cycle does not stop at the authentication layer, and financial institutions that treat identity security as the final defense will be repeatedly outmaneuvered.

Behavioral analytics, real-time threat intelligence, and automated anomaly response are the layers that catch what authentication cannot. Peris.ai was built to operate at this level, with BrahmaFusion providing the intelligence-driven automation that financial security teams need to stay ahead of AI-powered fraud.

Visit peris.ai to see how Peris.ai’s agentic AI platform protects financial institutions from the next generation of BEC attacks.

Frequently Asked Questions

What is AI-powered BEC?

AI-powered business email compromise uses generative AI to create hyper-personalized, stylistically accurate executive impersonation emails, increasing click-through rates by up to 450% versus traditional phishing.

How does adversary-in-the-middle (AiTM) phishing bypass MFA?

AiTM phishing intercepts a user’s live authentication session, capturing the session token after the user completes genuine MFA. The attacker uses the captured token to authenticate as the user without ever needing the password or MFA code.

What are the signs of a dual-channel BEC attack?

An unsolicited request arriving simultaneously via email and phone or SMS, with urgency framing and a request that bypasses normal approval processes, is a strong indicator of a dual-channel BEC operation.

How much do BEC attacks cost financial organizations?

The FBI IC3 reported $2.7B+ in BEC-adjusted losses in 2024. The median ransom demand in financial services reached $3 million in 2026.

How does behavioral analytics catch AI-generated BEC emails?

Behavioral analytics focuses on communication context, not content: unusual timing, new payees, bypassed workflows, mismatched session activity, and infrastructure anomalies that AI-generated text cannot replicate.

On May 11, 2026, the Nitrogen ransomware group listed Foxconn on its public leak site, claiming exfiltration of approximately 8TB of data spanning more than 11 million files. Foxconn confirmed disruption to North American operations the following day. Here is why manufacturers are the next major ransomware battleground.

Foxconn is not a small target. It is one of the largest electronics manufacturers on the planet, a supplier to Apple, Microsoft, and Sony, operating factories on multiple continents. If Nitrogen ransomware can penetrate Foxconn’s North American operations and walk out with 8TB of sensitive data, no manufacturer should consider itself safe.

This post examines how Nitrogen operates, why the manufacturing sector has become a primary target, and what security architecture prevents an EDR killer from disabling your defences before the encryption begins.

What Is Nitrogen Ransomware?

Nitrogen ransomware is a ransomware-as-a-service (RaaS) operation that gained significant attention in 2026 for its targeting of large manufacturing, industrial, and logistics organisations. The group maintains a public leak site, NitroBlog, where it lists confirmed victims and publishes exfiltrated data to pressure ransom payment.

Nitrogen’s defining technical characteristic is its use of EDR killers as a standard pre-attack preparation step. EDR killers are tools specifically designed to disable, crash, or evade endpoint detection and response software before the ransomware payload is deployed. Their inclusion in Nitrogen’s standard attack playbook reflects a sector-wide trend: Kaspersky’s 2026 International Anti-Ransomware Day report confirmed that EDR killers are now standard components of ransomware attack chains across the industry.

How Nitrogen Gets In: The Malvertising Initial Access Vector

Nitrogen does not rely on zero-day exploits for initial access. Its approach is more insidious: malvertising campaigns that deliver trojanized installers of legitimate, trusted software.

The tools commonly used as lures include:

• WinSCP (popular Windows file transfer tool)
• AnyDesk (remote desktop software widely used in manufacturing IT)
• Advanced IP Scanner (network administration tool)
• PuTTY (SSH client used by IT and OT teams)

An IT technician searching for a free download of WinSCP may land on a malvertised page serving a trojanized installer that looks identical to the legitimate version. The installer runs, the legitimate software installs correctly, and in the background Nitrogen’s initial access malware establishes persistence. The technician sees nothing unusual.

The Foxconn Attack: Timeline and Impact

• May 11, 2026: Nitrogen lists Foxconn on NitroBlog, claiming exfiltration of 8TB of data across more than 11 million files
• May 12, 2026: Foxconn publicly confirms disruption to North American operations, affecting facilities in Wisconsin and Texas
• Scope of data claimed: manufacturing specifications, supplier contracts, employee records, and operational data

The attack follows a pattern that Nitrogen has repeated across multiple manufacturing sector targets in 2026. The group increasingly favours encryptionless extortion, exfiltrating data and threatening to publish it rather than encrypting systems and demanding a decryption key.

Why Is Manufacturing a Ransomware Target?

Operational Technology Exposure

Modern manufacturing environments blend IT systems with OT (operational technology): industrial control systems, SCADA platforms, programmable logic controllers, and connected assembly-line equipment. These OT systems are often decades old, running software that cannot be updated without re-certifying the manufacturing process.

High Operational Cost of Downtime

A ransomware-induced shutdown of a manufacturing line costs thousands to tens of thousands of dollars per hour in lost production.

Interconnected Supply Chains

A breach at Foxconn has downstream implications for every organisation in its supply chain.

What Happens When EDR Is the First Casualty?

Nitrogen’s EDR killer deployment is specifically designed to neutralise your primary detection capability before the attack proceeds. When EDR is disabled:

• Endpoint behavioural detection goes dark
• The ransomware payload deploys without triggering the controls that should stop it
• Security teams receive no alerts until encryption is already underway
• Recovery scope expands dramatically because the attack was uncontained

Nitrogen Attack vs. Defended Environment

How Peris.ai Defends Manufacturing Environments

Our EDR provides behavioural detection on industrial endpoints and IT workstations. Critically, Peris.ai’s EDR is designed to resist EDR killer techniques through tamper-protection mechanisms.

Our XDR extends detection to the full manufacturing environment, including OT network segments. In a factory where industrial control systems share network infrastructure with corporate IT, XDR correlates telemetry across both layers.

Our NVM (Network Visibility Monitor) provides packet-level analysis of all traffic traversing the factory network. Nitrogen’s data exfiltration, typically multi-gigabyte transfers to external infrastructure, generates distinctive network traffic patterns that NVM detects and flags regardless of endpoint agent status.

BimaRed monitors the attack surfaces that Nitrogen exploits for initial access: internet-facing management interfaces, exposed OT systems, and vulnerabilities in IT administration tools.

BrahmaFusion ties the detection layers together with automated response playbooks. When XDR or NVM surfaces Nitrogen indicators, BrahmaFusion triggers network segmentation rules that isolate affected systems from OT infrastructure before encryption can spread to production lines.

Benefits at a Glance

Final Thought

Nitrogen ransomware listed Foxconn on May 11, 2026. The group will list its next target soon. For manufacturing security teams, the question is not whether their sector is being targeted. It is whether their detection architecture will survive an EDR killer long enough to contain the attack.

Platforms like BrahmaFusion by Peris.ai, combined with XDR, NVM, and INDRA CTI threat intelligence, give manufacturing security teams the layered, agent-independent detection and automated response capability they need to stop Nitrogen and groups like it before the production line goes dark.

Frequently Asked Questions

What is Nitrogen ransomware?

Nitrogen is a ransomware-as-a-service operation that targets manufacturing, industrial, and logistics organisations. The group uses malvertising campaigns to deliver trojanized installers of legitimate tools, deploys EDR killers to disable endpoint detection, and increasingly uses encryptionless extortion by threatening to publish stolen data.

How did Nitrogen ransomware attack Foxconn?

On May 11, 2026, Nitrogen listed Foxconn on its leak site claiming 8TB of exfiltrated data across 11 million or more files. Foxconn confirmed disruption to North American operations including facilities in Wisconsin and Texas on May 12, 2026.

What is an EDR killer and how does it work?

An EDR killer is a tool designed to disable, crash, or evade endpoint detection and response software before a ransomware payload deploys. By neutralising the primary detection control, attackers create a window where encryption or exfiltration proceeds without triggering alerts.

Why does Nitrogen use malvertising as an initial access vector?

Nitrogen uses malvertised downloads of legitimate IT tools (WinSCP, AnyDesk, Advanced IP Scanner, PuTTY) because these tools are trusted and regularly downloaded by IT and OT teams in manufacturing environments.

How can manufacturers defend against EDR killer attacks?

Effective defence requires layered detection that operates independently of endpoint agents. This includes network-level visibility (NVM), cross-layer XDR that monitors OT/IT boundaries, EDR with tamper-protection capabilities, and automated isolation playbooks.

Meta Lede: Stryker was cyberattacked in March 2026. 22% of hospitals have had attacks impact medical devices directly. IoMT security is now a patient safety issue.

On March 11, 2026, Stryker, one of the world’s largest medical technology companies supplying surgical equipment and devices to hospitals across the globe, was disrupted by a cyberattack affecting operations worldwide.

This was not a data breach. Stryker’s attack disrupted the operational continuity of a company whose devices are used in operating rooms, ICUs, and emergency departments every hour of every day. And Stryker is not an isolated case. By 2026, 22% of healthcare organizations have experienced cyberattacks that directly impacted medical devices, and 75% of those incidents disrupted patient care. In 24% of medical device attack cases, patients required transfer to other facilities.

Former FBI officials have proposed terrorist designations for ransomware hackers targeting hospitals, reflecting the recognized severity: when medical devices go offline, patients can die. The Internet of Medical Things (IoMT) is no longer just an IT problem. It is a critical care problem.

What Is IoMT Security and Why Is It Different from Standard Healthcare IT Security?

IoMT (Internet of Medical Things) security refers to the protection of network-connected medical devices: infusion pumps, patient monitors, imaging systems, surgical robots, ventilators, diagnostic equipment, and the thousands of other connected devices deployed across modern hospital environments.

IoMT security differs fundamentally from standard healthcare IT security in three ways:

• Devices cannot be patched on a normal cycle. Medical device firmware updates require FDA clearance or CE marking in most jurisdictions. A vulnerability disclosed today may not have a patch available for 12 to 18 months.
• Agents cannot be installed. Most medical devices run proprietary operating systems that cannot accept security agent software. Standard EDR deployment is impossible.
• Device failure directly harms patients. Unlike an email server outage, a compromised ventilator or infusion pump creates an immediate clinical risk.

By 2026, smart hospitals deploy more than 7 million IoMT devices globally, double the level from 2021.

What the Stryker Attack Reveals About Medical Technology Vulnerability

The March 11, 2026 attack on Stryker demonstrates that the vulnerability extends beyond individual hospital networks to the medical technology supply chain. A cyberattack that disrupts Stryker’s operations can simultaneously affect:

• Supply chain continuity for hospital procurement teams
• Software update distribution for connected Stryker devices already deployed in hospitals
• Remote monitoring and diagnostics capabilities for equipment under service contracts
• Customer support and technical assistance for clinical staff

The Scale of the IoMT Security Crisis in 2026

By the Numbers

• 7 million+ IoMT devices deployed in smart hospitals globally (double 2021 levels)
• 22% of healthcare organizations experienced cyberattacks directly impacting medical devices
• 75% of medical device attacks disrupted patient care
• 24% of medical device attacks required patient transfers to other facilities
• $10.9 million average cost of a hospital ransomware attack (downtime, recovery, regulatory fines)
• 276 million health records breached in 2024 alone

How Peris.ai Addresses IoMT Cybersecurity

Agentless Medical Device Monitoring with NVM

Because agents cannot be installed on medical devices, the detection layer must be network-based. Peris.ai’s NVM (Network Visibility Monitor) performs passive packet-level inspection of medical device network traffic without requiring any software installation on the devices themselves and without causing any device operational impact.

NVM establishes behavioral baselines for each device type: the normal communication patterns of an infusion pump differ from those of a patient monitor. Deviations from baseline, including unexpected outbound connections, unusual authentication attempts, and command-and-control traffic patterns, trigger alerts without disrupting device function.

Cross-Network Threat Detection with XDR

Peris.ai’s XDR platform correlates signals from NVM (medical device network), EDR (clinical IT endpoints), and cloud environments into a unified detection view.

Automated Clinical Isolation with BrahmaFusion

BrahmaFusion, Peris.ai’s agentic AI and hyperautomation platform, enables automated response playbooks specifically designed to isolate compromised devices without disrupting clinical workflows. When NVM detects anomalous communication from a medical device, a BrahmaFusion playbook can:

• Isolate the affected device’s network access at the switch level without powering down the device
• Alert clinical biomedical engineering and the security team simultaneously
• Trigger a structured incident response workflow via Peris.ai IRP
• Preserve all network traffic captures for forensic investigation

Healthcare-Specific Threat Intelligence with INDRA CTI

INDRA CTI provides healthcare sector-specific threat intelligence: ransomware group tactics targeting medical devices, active campaign IOCs for healthcare-focused threat actors, and vulnerability intelligence for common medical device platforms and operating systems.

Real-World Scenario: A Ransomware Attack on Hospital IoMT

A regional hospital system with 2,400 connected medical devices across three facilities:

• An attacker gains initial access through a phishing email to a hospital IT administrator
• They move laterally through the hospital IT network to reach the medical device VLAN, which lacks proper segmentation
• An infusion pump with a known unpatched CVE is exploited as a pivot point into the medical device network
• Ransomware is deployed targeting the device management server and clinical data systems simultaneously
• 40 infusion pumps require manual operation; two ICU patients require transfer to another facility
• Total incident cost: $12.4 million over 8 weeks of recovery

With Peris.ai: NVM detects the lateral movement into the medical device VLAN. BrahmaFusion isolates the compromised VLAN segment while preserving device function. The infusion pump CVE exploitation is flagged before pivot occurs. INDRA CTI confirms the attacker’s infrastructure matches a known ransomware group’s healthcare campaign.

Healthcare IoMT Security Priorities

Conclusion

The Stryker cyberattack and the data from 2026 make one thing clear: IoMT security is no longer a future concern. With 22% of healthcare organizations already experiencing attacks that directly impact medical devices and 24% of those incidents forcing patient transfers, the question is not whether your hospital will face an IoMT security incident, but whether you will detect it before it reaches patients.

Peris.ai’s healthcare security stack, built around agentless NVM monitoring, cross-network XDR detection, and clinically aware BrahmaFusion automated response, provides the coverage that standard IT security tools cannot deliver in medical device environments.

Don’t wait for a breach to take action. Secure your organization today. Stay Secure with Peris.ai.

Frequently Asked Questions

What is IoMT cybersecurity?

IoMT (Internet of Medical Things) cybersecurity refers to the protection of network-connected medical devices including infusion pumps, patient monitors, imaging systems, surgical equipment, and diagnostic devices against cyberattacks that could disrupt clinical operations or compromise patient safety.

What happened in the Stryker cyberattack in 2026?

On March 11, 2026, Stryker, one of the world’s largest medical technology companies, was disrupted by a cyberattack affecting its global operations, including supply chain, software update distribution, and technical support capabilities for its connected medical devices.

Why are medical devices difficult to secure against cyberattacks?

Medical devices are difficult to secure because they typically run proprietary operating systems that cannot accept security agents, require regulatory approval for firmware updates creating long patch cycles, and cannot be taken offline without clinical risk to patients.

How common are cyberattacks on medical devices?

As of 2026, 22% of healthcare organizations have experienced cyberattacks that directly impacted medical devices. Of those, 75% disrupted patient care and 24% required patient transfers to other facilities.

What is the best way to monitor medical device security without disrupting clinical operations?

Passive, agentless network monitoring (such as NVM) is the recommended approach. It inspects medical device network traffic at the packet level without installing any software on devices and without causing any operational impact.

Meta Lede: AI-powered voice cloning made CEO fraud nearly undetectable. BEC losses hit $2.77B. Here’s how the attack is built and what stops it.

The call lasted four minutes. The voice on the line sounded exactly like the CFO: same cadence, same regional accent, same habit of trailing off before giving a direct instruction. The finance team authorized a $400,000 wire transfer. The CFO never made that call.

Business email compromise (BEC) has evolved beyond email. Attackers now use generative AI to clone the voices and, increasingly, the video presence of C-suite executives to authorize fraudulent wire transfers, extract credentials, and bypass standard verification procedures. The FBI classifies AI-powered BEC as one of the fastest-growing, highest-value fraud categories targeting enterprises in 2026, with BEC generating $2.77 billion in losses across 21,442 incidents in the most recent FBI IC3 reporting period.

Detection is nearly impossible in real time. Few tools exist for live audio deepfake detection, and human ears are fundamentally unreliable at identifying AI-generated speech. This post explains exactly how deepfake CEO voice cloning fraud is constructed, why it works, and what controls can actually stop it.

What Is Deepfake CEO Voice Cloning BEC?

Deepfake CEO voice cloning BEC is a variant of business email compromise in which attackers use AI-generated audio (and increasingly video) to impersonate senior executives during phone or video calls. Rather than sending a fraudulent email, the attacker places a phone call using a voice synthesized from publicly available audio sources, directing employees to take financial or access-related actions under false authority.

The FBI reports a 312% spike in AI-assisted cybercrime targeting US citizens between 2024 and 2026. Q1 2026 alone saw 10.7 million BEC attacks, with 4 million occurring in March.

How AI Voice Cloning Attacks Are Built

The Preparation Phase

Attackers invest weeks before placing a single fraudulent call. They harvest voice samples from publicly available sources:

• Earnings call recordings and investor day presentations
• Conference keynote videos and panel recordings
• LinkedIn videos, podcast appearances, and media interviews
• Company website leadership videos

Using commercially available AI voice synthesis tools, they train a voice model requiring as little as 30 seconds of clean audio. The result is a synthesized voice that replicates emotional cues: urgency, frustration, reassurance, and fatigue, all of which human listeners rely on to assess credibility.

The Attack Execution

Calls are deliberately timed to create pressure: before long weekends, immediately before market close, or during known leadership travel. The attacker calls the finance team, accounts payable department, or IT helpdesk and poses as the CEO, CFO, or other executive.

In 2026, the dominant tactic is the “dual-channel” attack: a simultaneous voice call, a spoofed email from an executive address, and a spoofed SMS text message all arrive at the same time, creating apparent corroboration across three channels.

Why Human Detection Fails

AI-generated voices now replicate micro-level speech patterns including breath timing, hesitation markers, and stress patterns. Independent testing shows that under 3% of hyper-personalized deepfake interactions are detected by their targets using standard listening judgment.

Why Deepfake CEO Fraud Is Different from Traditional BEC

What Controls Actually Stop AI-Powered BEC

Challenge-Response Safe Words

The most immediately deployable control is a pre-established verbal safe word protocol between executive leadership and finance/IT teams. Any out-of-band financial or access request must be verified with a shared phrase that was established in person during onboarding and is rotated monthly.

Mandatory Dual-Approval Delay

All wire transfers above a defined threshold must require two independent approvals with a mandatory cooling-off period. No single voice call or message, regardless of claimed authority, can authorize a transfer without a second approver confirming through a separate verification path.

AI-Powered Anomaly Detection with BrahmaFusion

BrahmaFusion, Peris.ai’s agentic AI and hyperautomation platform, can monitor for unusual financial authorization patterns: requests arriving outside business hours, transfers to first-time beneficiary accounts, requests placed before public holidays, and dual-channel simultaneous contact patterns.

Incident Response Workflow with Peris.ai IRP

When a suspected CEO fraud attempt is detected or reported, a structured incident response workflow is essential. Peris.ai IRP provides unified case management to coordinate rapid investigation. Organizations using Peris.ai IRP have achieved 35% analyst workload reduction through this structured approach.

Threat Actor Attribution with INDRA CTI

INDRA CTI, Peris.ai’s cyber threat intelligence platform, tracks deepfake BEC campaign infrastructure: spoofed caller ID pools, campaign timing patterns, and affiliate groups operating specific CEO fraud campaigns.

Security Testing with Pandava

Pandava, Peris.ai’s penetration testing platform, includes social engineering scenarios specifically designed around simulated deepfake calls.

Real-World Scenario: A Dual-Channel CEO Fraud Attack

A regional bank’s CFO is traveling internationally for a conference:

• Attackers monitor the CFO’s LinkedIn and conference social media to confirm travel dates
• On Friday afternoon, three simultaneous contacts arrive: a spoofed email from the CFO’s address, a spoofed SMS from the CFO’s number, and a voice call using an AI-cloned version of the CFO’s voice
• The voice call requests an urgent $650,000 wire transfer to a new vendor account, citing a confidential acquisition
• The finance coordinator, seeing email and SMS corroboration, initiates the transfer
• Total time from first contact to wire authorization: 11 minutes

With BrahmaFusion’s anomaly detection: the new beneficiary account, Friday afternoon timing, and simultaneous multi-channel contact pattern trigger an automated hold and escalation. The transfer is flagged for manual review before execution. The fraud is stopped.

Benefits of an AI-Aware BEC Defense Program

Conclusion

AI voice cloning has turned CEO fraud from an email problem into a multi-channel social engineering crisis. With $2.77 billion in losses and a 312% increase in AI-assisted cybercrime, organizations that rely solely on email security controls are defending against the wrong threat vector.

The controls that work are behavioral, not perceptual: anomaly detection that flags unusual authorization patterns, structured incident response that creates mandatory friction, and security testing that trains your teams before attackers do. Peris.ai’s integrated platform gives security and finance teams the tools to detect, respond to, and learn from deepfake BEC attempts before they become wire transfer losses.

Don’t wait for a breach to take action. Secure your organization today. Stay Secure with Peris.ai.

Frequently Asked Questions

What is deepfake CEO voice cloning fraud?

Deepfake CEO voice cloning fraud is a form of business email compromise (BEC) in which attackers use AI-synthesized audio to impersonate C-suite executives during phone calls, directing employees to authorize wire transfers, share credentials, or bypass standard verification procedures.

How do attackers create a deepfake voice for CEO fraud?

Attackers collect voice samples from public sources such as earnings calls, conference videos, and podcast recordings. Using AI voice synthesis tools, they train a voice model requiring as little as 30 seconds of audio, producing a synthetic voice that replicates the target’s speech patterns and emotional cues.

How much money has been lost to BEC and deepfake CEO fraud?

The FBI reports $2.77 billion in BEC losses across 21,442 incidents in the most recent IC3 reporting period. AI-assisted cybercrime targeting US citizens increased 312% between 2024 and 2026.

Can deepfake phone calls be detected in real time?

Industry testing shows that fewer than 3% of hyper-personalized deepfake interactions are detected by their targets in real time. Human listeners cannot reliably distinguish AI-generated speech, particularly under time pressure.

What is the most effective control against AI voice cloning BEC?

A combination of pre-established verbal safe words, mandatory dual-approval delays for financial transfers, AI-powered behavioral anomaly detection (such as BrahmaFusion), and regular simulated deepfake testing (such as Pandava) provides the most effective layered defense.

More than 90,000 LLMjacking attempts were logged between late 2025 and early 2026. Criminal AI toolkits have removed safety guardrails from large language models and made sophisticated attacks accessible at industrial scale. Your AI infrastructure is now an attack surface.

The AI revolution in enterprise technology has a shadow side that most organisations are not yet defending against. While security teams focus on AI-powered phishing and deepfake fraud, a different category of threat has matured quietly: attacks against AI infrastructure itself.

LLMjacking is the act of hijacking an organisation’s AI infrastructure to run compute-intensive tasks at the victim’s expense. It is analogous to cryptojacking but targets GPU-backed inference endpoints instead of CPU cycles. Meanwhile, a parallel criminal AI ecosystem has emerged, purpose-built to remove the safety controls of mainstream AI models and make sophisticated cyberattacks, fraud, and social engineering accessible to anyone willing to pay a subscription fee.

This post examines both threats, the data behind their scale, and what security teams need to do before their AI investment becomes someone else’s attack platform.

What Is LLMjacking?

LLMjacking is the unauthorised use of an organisation’s AI model infrastructure, typically cloud-hosted LLM endpoints, to run inference tasks for the attacker’s benefit. The attacker does not steal data in the traditional sense. Instead, they consume the organisation’s compute resources, generating costs that can reach tens of thousands of dollars per day at scale.

The attack vector is straightforward: misconfigured API keys, exposed inference endpoints, and vulnerable proxy configurations give attackers access to AI services. Automated scanners probe for these exposures continuously. More than 90,000 LLMjacking attempts were logged between late 2025 and early 2026, driven largely by misconfigured open proxies that provide access to LLM service APIs.

The Criminal AI Toolkit Ecosystem

Parallel to LLMjacking, a mature criminal AI ecosystem has developed specifically to remove the ethical and safety guardrails that mainstream AI providers have built into their models. These purpose-built criminal LLMs serve the same function as legitimate AI models, but without restrictions on harmful content:

• WormGPT: generates convincing phishing emails, social engineering scripts, and malware code without the refusals that ChatGPT or Claude would produce
• WolfGPT: focused on financial fraud and business email compromise script generation
• EscapeGPT: specialises in jailbreaking and circumventing AI safety mechanisms
• FraudGPT: used for generating fake invoices, fraudulent financial documents, and identity theft scripts
• GhostGPT: targeted at creating evasive malware and exploit code

These tools are not hypothetical. They are available on underground markets with subscription pricing ranging from $100 to $1,500 per month, making sophisticated attack capabilities accessible to threat actors with minimal technical background.

The CrowdStrike 2026 Global Threat Report documented an 89% increase in AI-enabled adversary activity in 2025 compared to the prior year. All four major nation-state actors, China, Russia, Iran, and North Korea, had operationalised large language models in their attack chains by late 2025.

CVE-2025-53773: When AI Development Tools Become Attack Surfaces

The security risk of AI infrastructure extends beyond criminal toolkits. CVE-2025-53773 is a prompt injection vulnerability in GitHub Copilot that carries a CVSS score of 9.6. By embedding malicious instructions in pull request descriptions, an attacker could cause GitHub Copilot to execute arbitrary code on a developer’s workstation.

This vulnerability illustrates a category of risk that security teams are not yet systematically addressing: the AI tools embedded in the development workflow are themselves attack surfaces. Every AI-assisted code review, every AI-generated pull request summary, and every AI-powered development tool introduces a new vector for prompt injection, model manipulation, and supply chain compromise.

What Happens When AI Security Is Overlooked?

Organisations that deploy AI infrastructure without corresponding security controls face multiple compounding risks:

• Financial: LLMjacking can generate unexpected cloud bills of $10,000 to $50,000 or more per day when attackers run compute-intensive inference tasks at scale
• Operational: Consumed API quotas disable legitimate AI-powered workflows
• Data exposure: Attackers with access to AI inference endpoints may be able to extract training data or previous conversation context through prompt injection
• Competitive: Proprietary models trained on internal data may be accessible to attackers via compromised API endpoints
• Reputational: AI infrastructure used to generate attacker content may create attribution and liability issues

AI Security: Traditional Posture vs. AI-Aware Defence

How Peris.ai Secures AI Infrastructure

INDRA CTI tracks the criminal AI toolkit ecosystem continuously. WormGPT, FraudGPT, GhostGPT, and their successors are monitored through their infrastructure, distribution channels, and capability updates. When a new criminal AI toolkit is identified that targets a specific sector or is observed being used in campaigns against organisations similar to yours, INDRA CTI delivers that intelligence to your security team as actionable context rather than a news item.

BimaRed applies SAST to your AI and ML pipeline code. Prompt injection vulnerabilities, like CVE-2025-53773, are a class of code-level issue that static analysis can identify. BimaRed scans AI pipeline code for unsafe prompt handling patterns, unsanitised user input passed to model APIs, and dependencies with known AI-related vulnerabilities.

BrahmaFusion detects anomalous AI API usage through behavioural monitoring. LLMjacking generates distinctive patterns: sudden spikes in API calls, unusual times of day for high-volume inference requests, calls from unexpected IP addresses or service identities, and consumption patterns inconsistent with legitimate business workflows. BrahmaFusion triggers automated isolation playbooks when these patterns are detected, revoking the compromised credentials and blocking the offending access before the bill arrives.

Our XDR provides cross-layer detection for AI cloud service abuse. In cloud environments where AI inference runs alongside other workloads, XDR correlates anomalous AI service activity with related indicators in identity logs, network traffic, and endpoint activity to build a complete picture of the attack chain.

Scenario: Catching LLMjacking Before the $40,000 Bill

At 2:30am, BrahmaFusion detects an anomaly in the organisation’s AI inference endpoint usage: API call volume has increased 8,000% over baseline in the past 45 minutes. The calls are originating from an IP not associated with any known service identity.

With Peris.ai:

• BrahmaFusion immediately flags the anomalous API consumption pattern
• INDRA CTI matches the source IP to known LLMjacking infrastructure from a scanning campaign identified the prior week
• The compromised API key is revoked automatically
• The inference endpoint is temporarily restricted to approved IP ranges pending investigation
• Peris.ai IRP opens a case documenting the incident for the cloud security team
• Estimated cost of the LLMjacking attempt if undetected for 24 hours: $38,000. Cost of the containment: 12 minutes of automated response.

Benefits at a Glance

Final Thought

The AI infrastructure your organisation has invested in, the inference endpoints, the model APIs, the development tools with AI integration, is now part of your attack surface. The criminal ecosystem that has grown up around AI in 2025 and 2026 treats it as a resource to be exploited and a capability to be weaponised.

Platforms like BrahmaFusion by Peris.ai, combined with INDRA CTI’s criminal AI tracking and BimaRed’s AI pipeline security, give security teams the visibility and automated response needed to protect AI investments from becoming attacker infrastructure.

Frequently Asked Questions

What is LLMjacking?

LLMjacking is the unauthorised use of an organisation’s AI model infrastructure to run inference tasks at the victim’s expense. Attackers exploit misconfigured API keys or exposed inference endpoints to consume AI compute resources, generating costs of up to $50,000 or more per day. More than 90,000 LLMjacking attempts were logged between late 2025 and early 2026.

What are criminal AI tools like WormGPT and FraudGPT?

Criminal AI toolkits are purpose-built large language models that remove the safety guardrails of mainstream AI models. WormGPT generates phishing emails and malware code. FraudGPT creates fraudulent financial documents. GhostGPT produces evasive malware. These tools are available on underground markets for $100 to $1,500 per month.

What is CVE-2025-53773 in GitHub Copilot?

CVE-2025-53773 is a prompt injection vulnerability in GitHub Copilot with a CVSS score of 9.6. By embedding malicious instructions in pull request descriptions, an attacker could cause GitHub Copilot to execute arbitrary code on a developer’s machine.

How can organisations detect LLMjacking attempts?

Effective LLMjacking detection requires monitoring AI API usage for anomalous patterns: sudden spikes in call volume, requests from unexpected IP addresses or service identities, and consumption patterns inconsistent with normal business workflows. BrahmaFusion’s behavioural monitoring detects these patterns and triggers automated credential revocation before significant cost accumulates.

How has nation-state use of AI in attacks evolved?

According to CrowdStrike’s 2026 Global Threat Report, all four major nation-state actors (China, Russia, Iran, North Korea) had operationalised LLMs in their attack chains by late 2025, and AI-enabled adversary activity increased by 89% in 2025 versus the prior year.