AI as tradecraft: How threat actors operationalize AI

Microsoft Security Blog reports multiple large-scale, active threats and emerging attack patterns: threat actors are operationalizing AI (including North Korean groups Jasper Sleet and Coral Sleet) to scale tradecraft; malicious AI browser extensions harvested LLM chat histories and browsing data (≈900,000 installs, >20,000 enterprise tenants); Tycoon2FA—an AiTM phishing kit/PhaaS—enabled campaigns impacting ~500,000 organizations monthly and was disrupted by Microsoft DCU and partners; signed malware using a stolen EV certificate deployed legitimate RMM tools to maintain persistence; OAuth-0x