AI-Powered Ransomware Attacks Surge, Exploiting Human Trust and Credential Theft Proofpoint’s 2026 AI-Era Ransomware Report reveals that artificial intelligence is amplifying the success of ransomware attacks by enhancing phishing, impersonation, and credential theft campaigns. Based on a survey of 953 cybersecurity professionals across 12 countries, the study highlights a shift in ransomware tactics moving beyond encryption to sustained extortion through stolen data and repeated demands. In India, 62% of organizations affected by ransomware reported that AI increased attack effectiveness, with 16% citing a significant boost. Attackers are leveraging AI to craft more convincing phishing emails, automate reconnaissance, and exploit human trust at scale. The primary entry points remain human-dependent: phishing emails (42%), malicious links (71%), and business email compromise (47%). Despite warnings against ransom payments, 64% of affected Indian organizations paid, yet nearly half (48%) faced additional extortion demands. Data theft was confirmed in 71% of incidents, underscoring ransomware’s evolution into a multi-stage extortion scheme. When asked why attacks bypassed defenses, 49% of Indian respondents cited user interaction with malicious content, while 42% attributed it to deceptive authenticity evidence of AI’s role in blurring the line between legitimate and fraudulent communications. India recorded the highest user-interaction bypass rate (49%) among surveyed countries, alongside Japan and Singapore. The findings emphasize that ransomware now thrives by manipulating human behavior, not just exploiting technical vulnerabilities. As AI refines social engineering, organizations must address the human element to mitigate risks before attackers gain access.

North Korean Threat Actor Targets Developers in Large-Scale Phishing Campaign A likely North Korean threat actor has conducted a sophisticated phishing campaign, targeting nearly 100 organizations primarily in the U.S. with fake job offers and code-review requests to steal cryptocurrency and credentials. The operation, tracked by Proofpoint as UNK_DeadDrop, sent over 250 malicious emails in April and May 2026, focusing on employees in technology, education, finance, and cryptocurrency firms. ### How the Attack Worked The campaign used shifting pretexts including fake full-stack developer roles, AI payment agent projects, and ERC-4626 smart-contract testing to lure victims into cloning malicious GitHub or GitLab repositories. Once opened in VS Code or Cursor, a hidden tasks.json file executed automatically, exploiting a legitimate editor feature. - VS Code displayed a trust prompt, but Cursor ran the payload silently without user interaction. - The malware installed a fake Google-themed VS Code extension, ensuring persistence by relaunching on macOS and Linux whenever the editor reopened. - Linux/macOS systems received a Go-based remote access trojan (RAT) from the open-source Overlord framework, while Windows ran JavaScript directly in the editor, leaving no disk footprint. ### Data Theft & Wallet Drainage The malware targeted cryptocurrency wallets and browser credentials, including: - Browser extensions: MetaMask, Phantom, Keplr - Desktop wallets: Exodus, Electrum, Ledger Live - Saved passwords & cookies from Chrome, Brave, Edge, and Firefox To bypass security: - macOS/Linux displayed a fake password prompt, using the input to escalate privileges and dump keychains. - Windows bypassed Chrome’s app-bound encryption to extract data. After exfiltration, the malware deleted itself to evade detection. ### Attribution & Distinct Tactics While resembling Contagious Interview a long-running North Korean operation Proofpoint tracks UNK_DeadDrop separately due to its email-led delivery, large-scale repository creation, and self-contained payloads that persist even after infrastructure takedowns. Though attribution remains unconfirmed, the campaign aligns with North Korea’s history of targeting developers since 2022.

Ransomware Payments Fail to Guarantee Recovery, Proofpoint Data Reveals A recent Proofpoint survey highlights the risks of paying ransomware demands, with data showing that compliance does not ensure resolution. Among UK organizations hit by ransomware, 58% paid the ransom yet 22% faced repeat extortion, a rate slightly better than the global average of 37%. Regional payment rates varied widely, from 19% in Japan to 93% in the US, influenced by regulatory environments, insurance incentives, and cultural attitudes toward negotiation. The findings underscore a harsh reality: paying ransomware operators does not restore security. Even after payment, 2% of victims never recovered their files, while others encountered flawed decryptors such as a coding error in Nitrogen’s ESXi ransomware that left some data inaccessible. Law enforcement’s Operation Cronos, which dismantled the LockBit ransomware gang, confirmed long-held suspicions: attackers often retain stolen data even after receiving payment, undermining the assumption that compliance leads to resolution. Beyond ransomware itself, AI is sharpening the attacks that enable it. In the UK, 65% of security practitioners reported that AI has intensified threats like malicious links, business email compromise, and credential harvesting. While AI has not yet become a core tool in ransomware payloads, it is enhancing phishing lures, impersonation attempts, and post-breach reconnaissance making initial access more effective. As Proofpoint’s Ryan Kalember noted, modern ransomware attacks increasingly exploit human trust and identity, rather than relying solely on technical vulnerabilities.

The Salesforce data breach involved the ShinyHunters (UNC6240) hacking group, which exploited stolen OAuth tokens from Salesloft’s GitHub account to infiltrate Drift’s Salesforce integration and subsequently compromise Gainsight, a customer process management platform. The attackers gained unauthorized access to over 200 Salesforce instances, exfiltrating enterprise customer data through third-party service integrations (including HubSpot and Zendesk). While Salesforce revoked access keys and removed affected apps from the AppExchange, the breach exposed sensitive customer data, though the full scope of the leak remains undisclosed. The attack leveraged supply-chain vulnerabilities rather than a direct Salesforce platform flaw. ShinyHunters claimed delayed detection (1–2 weeks post-intrusion) and sought internal accomplices for further exploitation. Salesforce refused ransom demands, but the incident highlights risks in third-party integrations and credential-based attacks.

The Salesloft-Drift OAuth incident involved attackers stealing OAuth tokens from Salesloft’s development platform, exploiting them to access customer data across integrated applications like Salesforce and Google Workspace. The breach, executed by the threat group UNC6395, leveraged voice phishing (vishing) to trick administrators into authorizing malicious apps, bypassing multi-factor authentication (MFA). Over 700 organizations were impacted as the compromised tokens enabled attackers to exfiltrate sensitive customer information, leading to widespread revocation of Drift integrations. The incident exposed systemic risks in SaaS supply chains, where trusted third-party integrations became attack vectors, enabling potential data theft, cloud credential abuse, outages, or ransomware. Beyond immediate data exposure, the breach triggered forensic investigations, regulatory fines, lawsuits, reputational damage, and operational disruptions, highlighting the cascading risks of N-th degree vendor dependencies in modern cybersecurity ecosystems.

The incident at Gainsight stemmed from a downstream effect of the August 2025 Salesloft breach, where the Scattered Lapsus$ Hunters group stole OAuth tokens tied to Salesloft’s Drift AI chat integration with Salesforce. These tokens granted unauthorized API access to 760 Salesforce instances, leading to the exfiltration of 1.5 billion records, including passwords, AWS keys, and Snowflake tokens.A subgroup, ShinyHunters, exploited the stolen credentials to breach Gainsight’s systems, extracting customer contact data (names, business emails, phone numbers, regional details), licensing information, and support case contents. Salesforce responded by revoking all active Gainsight-associated tokens and temporarily removing its apps from the AppExchange to mitigate further exposure. While Salesforce clarified that its platform itself was not vulnerable, the breach originated from Gainsight’s external app connections, compromising sensitive corporate and customer data across hundreds of organizations.

Cybercriminals Hijack Freight Shipments in Sophisticated Supply Chain Attacks A financially motivated cybercrime group is targeting the surface transportation industry, using advanced tactics to steal physical cargo by compromising freight brokers and trucking carriers. Since August 2025, cybersecurity firm Proofpoint has tracked nearly two dozen campaigns involving thousands of malicious messages, resulting in the theft of high-value shipments including electronics and energy drinks which are later resold online or shipped overseas. The attackers exploit digital load boards, marketplaces where brokers and carriers arrange freight shipments, through three primary methods: - Compromised Load Boards: Using stolen credentials, they post fraudulent freight listings and send malicious links to responding carriers. - Email Thread Hijacking: They infiltrate legitimate email chains between supply chain partners, inserting malicious URLs into trusted conversations. - Direct Email Targeting: Broad phishing campaigns target logistics firms to identify and later steal high-value cargo. Once a victim clicks a malicious link, it downloads an executable or MSI file that installs legitimate but abused Remote Monitoring and Management (RMM) tools such as ScreenConnect, PDQ Connect, or LogMeIn Resolve enabling attackers to maintain control over compromised systems. While the threat actors remain unidentified, they demonstrate deep knowledge of trucking industry software and dispatch operations. To mitigate risks, Proofpoint recommends restricting unauthorized RMM tool installations, deploying network monitoring for suspicious activity, blocking executable email attachments, and training staff to recognize phishing attempts. As digital infrastructure becomes increasingly integral to supply chains, these attacks highlight the growing intersection of cyber threats and physical cargo theft, posing significant financial and operational risks to transportation companies.