AI as tradecraft: How threat actors operationalize AI

Microsoft Security Blog highlights a surge in AI-enabled and high-scale malicious activity: threat actors (including North Korean groups Jasper Sleet and Coral Sleet) are operationalizing AI to accelerate tradecraft; malicious browser extensions (nearly 900,000 installs across >20,000 enterprise tenants) harvested LLM chat histories and browsing data; Tycoon2FA—a leading AiTM phishing-as-a-service—reached ~500,000 organizations monthly before disruption; signed malware using a stolen EV certificate deployed legitimate RMM tools to establish persistent backdoors; OAuth redirection flows are now