AI as tradecraft: How threat actors operationalize AI

Microsoft Security Blog posts (Feb–Mar 2026) highlight an escalation in AI-enabled and supply-chain threats: threat actors (including North Korean groups like Jasper Sleet/Coral Sleet) are operationalizing AI to scale tradecraft; malicious AI browser extensions harvested LLM chat histories and browsing data (≈900,000 installs, impacting >20,000 enterprise tenants); Tycoon2FA, a leading AiTM phishing-as-a-service, reached hundreds of thousands of organizations monthly and was targeted for disruption by Microsoft DCU and Europol; signed malware using a stolen EV certificate deployed legitimate R