October 2026 — threat landscape briefing for operators
Quarterly briefing, distilled:
- Ransomware continues to shift toward data-only extortion; encryption is increasingly a secondary lever. Watch for double and triple extortion playbooks.
- Initial access: valid credentials via info-stealer logs keep outranking 0days in volume. Phishing kits with reverse-proxy session capture (Evilginx-style) remain the top delivery method.
- Cloud: cross-tenant attacks via over-permissioned service principals and leaked CI/CD tokens are the fastest-growing vector. Audit your own estates first.
- Supply chain: build-time poisoning of npm/pip packages shows no sign of slowing. Pin dependencies and sign artifacts.
- AI-assisted fraud: voice cloning is now a commodity in vishing campaigns.
What this means for us: the fundamentals still win — patch, MFA, least privilege, network segmentation, and monitoring that actually alerts.
- Ransomware continues to shift toward data-only extortion; encryption is increasingly a secondary lever. Watch for double and triple extortion playbooks.
- Initial access: valid credentials via info-stealer logs keep outranking 0days in volume. Phishing kits with reverse-proxy session capture (Evilginx-style) remain the top delivery method.
- Cloud: cross-tenant attacks via over-permissioned service principals and leaked CI/CD tokens are the fastest-growing vector. Audit your own estates first.
- Supply chain: build-time poisoning of npm/pip packages shows no sign of slowing. Pin dependencies and sign artifacts.
- AI-assisted fraud: voice cloning is now a commodity in vishing campaigns.
What this means for us: the fundamentals still win — patch, MFA, least privilege, network segmentation, and monitoring that actually alerts.