Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By The Intel 471 Analyst Team
Technology has enabled today’s businesses to move faster than ever, but cyber threats continue to constitute an ever-increasing risk for enterprises – from data thieves and hacktivists to extortionists and nation-states leveraging cyber for espionage and military advantage. Threat actors continue to dig deeper into how business processes are enabled by technology to find weak points. Rather than just stealing credentials, they’re stealing OAuth tokens. The rollout of artificial intelligence (AI) solutions and incorporation of AI technologies into enterprise workflows is creating a brand-new attack surface that security experts are only beginning to probe. Generative AI is proving to be a productivity tool for cybercriminals as well, allowing them to refine phishing campaigns, create deepfakes and generate a confusing information environment. Tried-and-true methods such as phishing also continue to heavily impact organizations, enabled by a cybercrime-as-a-service economy where other threat actors can buy login credentials in underground marketplaces for any organizations they want to target.
This hostile environment will not abate. In this piece, Intel 471 analysts look ahead at what may be in the cards for defenders in 2026.
AI-powered social engineering will get worse
The 2026 cybersecurity landscape will be critically shaped by the increasing sophistication of social engineering fueled by generative AI. The combination of an old technique – social engineering – with new AI tools has fundamentally enhanced the scale, precision and psychological impact of attacks. It has allowed adversaries to move away from broad, opportunistic scams toward highly personalized campaigns. AI-generated lures are now used to impersonate executives, spread misleading announcements, influence public opinion and support coordinated disinformation efforts with alarming accuracy.
As AI tools become more accessible, malicious actors are leveraging them to develop compelling phishing content, create hyper-realistic deepfake impersonations and produce synthetic media capable of influencing financial markets. This marks a paradigm shift from volume-based social engineering to a focus on quality. While AI currently functions primarily as an efficiency upgrade for profit-driven criminal groups – improving the quality of phishing schemes, business email compromise (BEC) lures and voice phishing (vishing) scripts – its practical adoption is poised to accelerate. The proliferation of AI models, coupled with an expected decrease in model hosting costs, will drive an expanding use of AI in everyday cybercrime. We anticipate a notable increase in AI-assisted vishing and voice deepfakes as tools become more widely available and threat actors gain expertise.
Deepfakes pose increasing challenges related to account creation and customer verification. While once limited to advanced users, deepfake technologies have evolved to become highly accessible, affordable and easy to use, with only a few visual imperfections still detectable to the untrained eye. However, these smoke screens and misdirections can be combated. While detecting deepfakes and AI-generated content is likely to become increasingly difficult, the provenance of some content may be able to be determined if it is compliant with attestation frameworks such as one developed by the Coalition for Content Provenance and Authenticity (C2PA). Understanding how deepfake generation tools operate enables the development of targeted detection strategies. These can include enhanced liveness detection techniques, human reviews, device fingerprinting, session anomaly detection, automatic document ID analysis and specialized training for high-risk teams that may be targeted, such as human resources (HR) and finance.
Infostealers, phishing kits will be a headache
The often-cited aphorism that identity is the new perimeter is still relevant. The ecosystem for piercing these perimeters continues to become more refined. Criminal groups are developing easier-to-use tools for other cybercriminals to commit crimes in the form of information-stealing (infostealer) malware and phishing-as-a-service (PhaaS) kits. Infostealers can be bought from malware developers who provide software-as-a-service (SaaS) such as control panels to monitor malware campaigns. Criminal pay-per-install (PII) services will distribute new infostealer strains to other already-infected computers for a fee. Once on computers, these infostealers can collect credentials, financial data, session tokens and other information from machines, which can be employed for fraud or resold to other fraudsters down the line.
PhaaS kits are increasingly using adversary-in-the-middle (AITM) techniques. Unlike conventional phishing attacks that rely on static hypertext markup language (HTML) templates, these kits use reverse proxies. When people are tricked into logging in, the phishing kit passes the details to the legitimate service provider, which returns a session token that is collected by the kit. This interaction appears completely legitimate to unsuspecting victims, and the session token can be reused to gain access to a system. The wide range of adversaries who leverage PhaaS kits – from ransomware affiliates to BEC scammers to the intrusion cluster of young threat actors known as the Com – is evidence of a dynamic environment where threat actors adapt and innovate.
There are effective defenses for countering credential theft, such as employing multifactor authentication (MFA). However, the replay of stolen session tokens will allow attackers access without needing to log in. The writing has been on the wall now for identity and access management (IAM) regimes that do not implement stronger authentication. Organizations should look to use phishing-resistant authenticators, such as hardware keys and other methods based on Fast Identity Online 2 (FIDO2) specifications, including passkeys or other passwordless systems.
Supply chain attacks will diversify
Software development greatly depends on open source software libraries distributed in repositories such as the Python Package Index (PyPi) and node package manager (npm), which is the package manager for JavaScript applications that run on the Node.js JavaScript runtime. Skilled attackers have seen this as an opportunity: subvert those software packages and it’s possible to compromise every application that depends on it. This played out in a very messy way in 2025 with npm. Attackers staged campaigns dubbed Shai-Hulud that compromised hundreds of npm packages using wormlike capabilities in two significant incidents. Another campaign targeted Nx, which is a build system package hosted on npm. These attacks have been centered on compromising developer credentials through phishing or credential reuse. Commercial vendors have created services to monitor software packages for possible malicious changes. However, we would venture that for the most part, developers download code libraries without a second thought and get on with their day, which is what threat actors are counting on.
Threat actors saw another supply chain attack avenue with OAuth, which allows for persistent access to another software system without revealing credentials. Rather than finding a vulnerability or stealing credentials, attackers have pursued capturing OAuth tokens, which can then be replayed. This occurred in the Salesloft incident in which OAuth tokens used to integrate a chatbot with Salesforce’s customer relationship management service were stolen and then used to access sensitive Salesforce data. It also occurred related to Gainsight, a customer success tool that plugs into Salesforce. The rub for organizations using OAuth is that the security of their data may be closely tied to how their partner protects their OAuth tokens, which, as we’ve seen, may not be watertight. These nontraditional ways to achieve compromise can be difficult but not impossible for targeted organizations to detect, which makes us predict that capable attackers will embrace these vectors in the next year.
Geopolitics will drive cyber conversations
Geopolitics is a primary catalyst driving conversations and activity across the cyber threat landscape. Major geopolitical events such as the Russia-Ukraine war and heightened U.S.-China tensions have already elevated the skill and visibility of state-aligned cyber operations. These threats are neither random nor opportunistic; they are strategically driven by political and economic objectives.
State-sponsored actors, hacktivists and their proxies leverage cyber capabilities to target critical infrastructure, spread disinformation and conduct espionage alongside diplomatic or military actions. National elections, trade disputes and other high-stakes political moments routinely trigger surges in this activity. Increasingly, financially motivated cybercriminals overlap with these groups, whether by acting as contractors, selling access or exploiting the same geopolitical flash points – further blurring the lines between traditional crime and state influence in cyberspace. Sometimes, the same actor may act in both capacities. In 2025, it was discovered that an operative of a Chinese advanced persistent threat (APT) group reportedly had been moonlighting for several months as an operator for a well-known ransomware group for personal financial gain, even asking for nearly US $2 million from one victim. As nations escalate their investments in cyber capabilities, and given the unpredictable global political climate, the frequency and sophistication of state-aligned or state-sponsored attacks are likely to continue to rise in 2026 and beyond.
To effectively mitigate these risks, cyber threat intelligence (CTI) teams should aim to integrate geopolitical context into regular threat intelligence reporting. By framing intelligence in terms of geopolitical events, CTI teams can provide timely, actionable insights for defense, such as flagging increased cyber activity against specific sectors that align with ongoing political tensions.
##
