Threat actor abuse of AI accelerates from tool to cyberattack surface

Microsoft Security Blog posts (Mar–Apr 2026) detail a surge in attacker capabilities driven by generative AI and multiple high‑impact supply‑chain and malware campaigns. Key highlights: AI abuse increasing phishing success and enabling industrialized MFA bypass; an Axios npm supply‑chain compromise (attributed to North Korean actor Sapphire Sleet) that distributed malware via malicious package updates; a Trivy distribution compromise that injected credential‑stealing malware into CI/CD; cookie‑gated PHP webshell tradecraft using php‑fpm, obfuscation, and cron persistence to evade detection in