AI as tradecraft: How threat actors operationalize AI

Collection of Microsoft Security Blog posts (Feb–Mar 2026) describing how adversaries are operationalizing AI and abusing common trust mechanisms to scale attacks. Key items: threat actors (including North Korean groups Jasper Sleet and Coral Sleet) are using AI to accelerate tradecraft; malicious AI browser extensions harvested LLM chat histories and browsing data across ~900k installs and >20k enterprise tenants; Tycoon2FA — a large AiTM phishing-as-a-service — enabled campaigns impacting hundreds of thousands of organizations and was targeted for disruption; signed malware using a stolen EV