AI as tradecraft: How threat actors operationalize AI

Microsoft Security Blog posts (Feb–Mar 2026) describe multiple high‑impact trends and active campaigns: threat actors are operationalizing AI to scale tradecraft (including activity by North Korean groups Jasper Sleet and Coral Sleet); nearly 900,000 installs of malicious AI browser extensions harvested LLM chat histories and browsing data across >20,000 enterprise tenants; Tycoon2FA (an AiTM phishing kit/PhaaS) enabled campaigns reaching hundreds of thousands of organizations and was disrupted by Microsoft DCU and partners; signed malware using a stolen EV certificate deployed legitimate RMMs