CrowdStrike's 2026 Threat Hunting Report documents a shift security teams have been anticipating but may not be fully prepared for: AI is no longer an experiment in adversary operations. It is a production component, embedded in specific campaign workflows, supply chain operations, and social engineering pipelines.
AI framework package poisoning: DPRK's STARDUST CHOLLIMA
The report's most operationally significant finding is that STARDUST CHOLLIMA, a North Korean threat actor cluster, poisoned 131 AI framework packages. Targets included Mastra AI, an open-source AI orchestration framework. This is not a theoretical concern: it is a named nation-state actor targeting the specific tools that AI engineering teams are adopting right now.
Any organization using open-source AI orchestration frameworks should treat this as an active risk. The infection vector is standard: malicious packages uploaded to public registries under names that match popular packages or typosquat common imports. The novelty is the target category.
Supply chain tempo: 300 compromises in one day
ALTERED SPIDER, a separate actor tracked in the report, compromised 300 software dependencies in a single day. Not over a quarter, not over a campaign: in one day. This operational tempo implies automation driving the compromise workflow, which is consistent with AI-assisted tooling.
Exploitation speed: 88% within 48 hours of PoC
88% of exploitation attempts now occur within 48 hours of proof-of-concept publication. This eliminates any assumption that a 30-day patch cycle gives a safety buffer after a PoC drops. By day 2, most adversaries who are going to exploit a vulnerability are already attempting it.
Credential and social engineering escalation
Three vectors saw dramatic increases: cloud eCrime incidents up 171%, vishing (voice phishing) attacks doubled, and device code phishing increased 15x year-over-year. The device code phishing increase is particularly significant because it abuses OAuth device authorization flows present in essentially every enterprise environment using a cloud identity provider.
What defenders should do
- Audit AI framework dependencies in your build pipeline. If you use open-source LLM orchestration tools (LangChain, Mastra AI, CrewAI, AutoGen, others), run a software composition analysis scan and verify package provenance.
- Treat PoC publication as a 48-hour patch window, not a 30-day one. The exploitation window has permanently compressed.
- Review device code authorization flows in your identity provider. Restrict or disable device code grants for accounts that do not need them, especially privileged accounts.
- Include vishing scenarios in security awareness training. The 2x increase in voice phishing means users are more likely to receive a call than an email as the initial attack vector.
Context
CrowdStrike's threat hunting team handles incident response across thousands of organizations globally. This report reflects data from those engagements, not scanned telemetry alone. Findings on AI package poisoning and supply chain compromise tempo are based on observed hands-on-keyboard threat actor activity.