ITSEC Asia Warns of Rising AI-Powered Cyberattacks

ITSEC Asia has released a new threat intelligence whitepaper examining how artificial intelligence is reshaping global cyberattack operations. Titled AI-Powered Cyberattacks in the Global Threat Landscape, the research identifies a growing shift towards autonomous AI agents capable of conducting multiple stages of cyberattacks with limited human intervention.

Based on reported cyber campaigns and global threat intelligence, ITSEC Asia's Threat Intelligence Team found that AI is increasingly being used to automate reconnaissance, exploit vulnerabilities, collect credentials and extract or destroy sensitive data. As these capabilities become cheaper and more accessible, sophisticated cyberattacks are becoming easier to execute, reducing the time organizations have to detect and respond to threats.

A case reported by Reuters in October 2026 described how a hacker used AI agents and a budget of a few thousand US dollars to compromise scores of websites. Other research cited in ITSEC Asia's whitepaper reported automated operations targeting online retailers at an estimated cost of approximately US$25 per company.

Patrick Dannacher, President Director of ITSEC Asia, said "AI is changing the economics of cybercrime. Attackers can now carry out activities that previously required considerable technical expertise, time and resources at a much lower cost. For businesses, this creates a different level of exposure. Security teams need to recognize that attacks can move faster, reach more targets and affect critical systems before conventional response processes can catch up. Preparing for this shift requires organizations to rethink how they protect their infrastructure, identities and data,"

Five Cases Reveal How AI Is Changing Cyberattacks

ITSEC Asia's research examines five cases that demonstrate how AI and automation are being used across different types of cyber operations.

One of the most concerning examples is JadePuffer, also associated with Microsoft's Storm-3168 activity. The campaign demonstrates how AI agents can adapt their actions during an intrusion, targeting databases, cloud environments and enterprise AI assets. Reported destructive activities include database deletion and attacks against AI models and training data.

Another case, Scarlet Loop, focuses on automated account takeover and financial theft. Its infrastructure reportedly scanned 84,660 URLs across 107 countries and 47 sectors, identifying 6,171 high value domains. The operation targeted accounts holding financial value, including digital wallets, loyalty programs and employee rewards.

The research also examines ARTEX, a framework that coordinates multiple AI agents to conduct reconnaissance, vulnerability scanning and exploitation, and CAIRN, an autonomous platform associated with attacks against more than 1,200 websites and the reported theft of over 600,000 active payment card details.

The fifth case covers cyber incidents affecting Japanese organizations between September and October 2026. Approximately 36.55 million customer accounts and records were potentially affected across several organizations. These incidents highlight vulnerabilities in shared cloud infrastructure, third-party access and interconnected digital services, although the research does not establish AI involvement in every incident.

Together, the cases demonstrate how cyber threats are expanding beyond conventional endpoint attacks to affect cloud environments, customer accounts, financial transactions, databases and enterprise AI systems.

Businesses Need to Prepare for Faster Threats

The research identifies compromised cloud identities as one of the highest priority risks. Attackers can exploit stolen credentials and excessive permissions to access cloud resources and move across systems, sometimes without deploying traditional malware.

Enterprise AI infrastructure is also becoming a target. As businesses rely more heavily on AI models, training datasets and machine learning pipelines, these assets are increasingly exposed to theft, extortion and destruction.

ITSEC Asia recommends that organizations strengthen their defenses in four areas. First, behavioral threat detection should be improved through technologies such as Extended Detection and Response (XDR) and User and Entity Behavior Analytics (UEBA). Second, Zero Trust security principles should be applied to strengthen identity verification, restrict access and limit unauthorized movement across systems.

Third, organizations should increase automation in their incident response through Security Orchestration, Automation and Response (SOAR), allowing security teams to contain threats faster. Finally, dedicated security practices for machine learning systems, known as Machine Learning Security Operations (MLSecOps), should protect AI models, training data and related infrastructure.

The research forecasts that agentic ransomware, cloud identity abuse, AI enabled fraud and attacks targeting enterprise AI infrastructure will become increasingly relevant over the next 6 to 12 months.

“Ultimately, cybersecurity is a business responsibility. As organizations adopt AI across their operations, security considerations need to be part of every strategic decision, from technology investments to how data is managed and who has access to critical systems. The organizations that take this seriously today will be in a better position to protect their customers, maintain trust and sustain their business in the years ahead,” Patrick added.

Access the Research

AI-Powered Cyberattacks in the Global Threat Landscape is a threat intelligence whitepaper prepared by the ITSEC Asia Threat Intelligence Team and issued in November 2026.

The report examines global AI related cyber operations, selected threat campaigns, attacker techniques, business impacts and recommended defensive measures.

The full whitepaper can be accessed through the Whitepapers section of ITSEC Asia's Investor Relations page: https://qrfy.io/r/whitepaper-nov26