Threat actor abuse of AI accelerates from tool to cyberattack surface

A collection of Microsoft Security Blog posts (late Mar–early Apr 2026) describing an uptick in AI‑enabled offensive tradecraft and multiple active supply‑chain and delivery campaigns. Key items: AI is being abused to increase phishing success (reported ~450% higher click‑through) and to industrialize MFA bypass; the Axios npm supply‑chain compromise (malicious packages attributed to North Korean actor Sapphire Sleet) and Trivy distribution compromise injected credential‑stealing malware into CI/CD pipelines; cookie‑controlled PHP webshells use obfuscation, php‑fpm execution, and cron‑based/pk