AI as tradecraft: How threat actors operationalize AI

Microsoft Security Blog highlights multiple high-impact adversary techniques and trends: threat actors (including North Korean groups Jasper Sleet and Coral Sleet) are operationalizing AI to scale tradecraft; malicious AI browser extensions have harvested LLM chat histories and browsing data at scale (nearly 900,000 installs, activity across >20,000 enterprise tenants); Tycoon2FA (an AiTM PhaaS) enabled phishing campaigns affecting hundreds of thousands of organizations and was disrupted by industry law‑enforcement actions; signed malware using a stolen EV certificate deployed legitimate RMMs为