Threat actor abuse of AI accelerates from tool to cyberattack surface

Collection of Microsoft Security Blog posts (Mar–Apr 2026) describing elevated, real-world threats and mitigation guidance: generative AI is being abused to scale social engineering (notably much higher phishing click‑throughs) and industrialize MFA bypass; cookie‑gated PHP webshells use obfuscation, php‑fpm execution, and cron persistence to evade detection in Linux hosting environments; an Axios npm supply‑chain compromise (published Mar 31, 2026) distributed malicious packages that reached out to C2 and has been attributed to North Korean actor Sapphire Sleet; a separate Trivy supply‑chain​