AI, infostealers, vulnerabilities, ransomware, and geopolitical conflict are reshaping organisational risk and compressing the time defenders have to respond, according to Flashpoint’s latest 2026 Global Threat Intelligence Report: Midyear Edition.
The threat intelligence organisation tracked more than 22-million illicit discussions involving criminal AI toolkits, 7,4-million infected hosts yielding 1,7-billion stolen credentials, more than 21 600 disclosed vulnerabilities in six months, and a 45% increase in ransomware-as-a-service activity compared to the previous reporting period.
Together, these trends demonstrate that AI-driven attacks have moved from experimentation to operational deployment – increasing the speed, scale, and sophistication of modern cybercrime.
“AI is compressing the time between opportunity and exploitation. Capabilities that once took significant expertise, coordination, and time to develop are becoming faster to build, easier to scale, and harder to detect,” says Josh Lefkowitz, co-founder and CEO of Flashpoint. “Security teams are facing an adversary ecosystem that can use AI to iterate at unprecedented speed – the only way to keep pace is with primary-source intelligence that surfaces adversary behaviour before attacks unfold.”
AI is accelerating every stage of the attack lifecycle
Flashpoint observed more than 22-million illicit discussions centred on AI during the first half of 2026, reflecting the growing availability of malicious AI toolkits and customised language models designed specifically for cybercrime. Rather than relying on public underground communities for development, threat actors are increasingly deploying locally hosted, safeguard-free AI models capable of generating phishing campaigns, malware, exploit code, and social engineering content at machine speed.
Identity continues to replace traditional network intrusion
The report found that infostealers infected more than 7,4-million hosts globally, harvesting approximately 1,7-billion credentials and identity artifacts during the first six months of the year. These stolen credentials increasingly enable attackers to bypass traditional security controls by authenticating with legitimate user identities rather than exploiting technical weaknesses, reinforcing identity as one of today’s most critical attack surfaces.
Vulnerability management is becoming a race against AI
Flashpoint tracked 21 667 vulnerability disclosures between January and June 2026, with nearly one in five already accompanied by public or functional exploit code. At the same time, organisations face growing pressure from AI-assisted exploit development, expanding Known Exploited Vulnerabilities (KEV), and delays in public vulnerability enrichment. The report concludes that effective vulnerability management increasingly depends on prioritising exploitable risk rather than severity scores alone.
Ransomware operations continue to scale
Flashpoint documented 6 256 verified ransomware victims during the reporting period – a 45% increase over the first half of 2025. Although fewer organisations are paying ransom demands, ransomware operators continue expanding activity through automation, lower-cost initial access, and mature Ransomware-as-a-Service ecosystems that make sophisticated attacks more accessible to a broader range of threat actors.
Geopolitical conflict is expanding enterprise risk
The report also examines how geopolitical instability increasingly intersects with cyber operations. During the first half of 2026, military conflict in the Middle East coincided with coordinated cyber campaigns targeting supply chains, financial institutions, industrial systems, and critical infrastructure, illustrating how geopolitical events can rapidly create operational risk for organisations well beyond the immediate conflict zone.
The full 2026 Global Threat Intelligence Report: Midyear Edition is available here.