Malware and Vulnerability Trends in the First Half of 2026: Abuse of Legitimate Tools and AI-Assisted Attacks Emerge as Defining Features

In the first half of 2026, the global cybersecurity threat landscape presents an intriguing characteristic: attackers are not rushing to embrace mysterious new technologies, but instead prefer to "abuse tools and services that appear normal." From remote access trojans (RATs) to ransomware, and then to supply chain attacks, malicious actors skillfully blend into trusted software, developer tools, and cloud workflows. A new research report from Insikt Group, the threat intelligence arm of Recorded Future, titled "H1 2026 Malware and Vulnerability Trends," points out that this strategy of "evasion through normalcy" is making malicious activity more difficult for defenders to detect at an early stage.

Event Overview: A Fact Sheet from the First Half of the Year

The report covers malware and vulnerability data from January to June 2026, based on Insikt Group's analysis and submission records from the Recorded Future Malware Intelligence platform. Key data includes:

• 215 actively exploited CVEs, a 34% surge from 161 in the same period last year. Of these, 146 vulnerabilities can be exploited without pre-authentication, while 142 meet the conditions of being network-reachable and requiring no authentication simultaneously. More concerning, 60 remote code execution (RCE) vulnerabilities also possess the "network-reachable + no authentication" attribute, meaning a large number of vulnerabilities can be remotely weaponized.
• RATs remain a long-term threat to enterprise security. AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS RAT ranked in the top ten in both H1 2025 and H1 2026. AsyncRAT ranked first among all malware submissions by unique hash and C2 configuration count.
• Ransomware operators continue to optimize, but have not invented entirely new attack paradigms. They continue to rely on ClickFix-style social engineering, exploiting vulnerabilities in internet-exposed applications, and even directly abusing legitimate tools such as s5cmd, PsExec, and AnyDesk.
• Android NFC malware has become the most prominent mobile threat, with families such as NFCShare and NGate exploiting devices' NFC capabilities to steal payment card data, relay contactless transactions, and even enable ATM cash-out.

Technical and Risk Analysis: Legitimate Tools Become Attackers' "Camouflage"

Vulnerability Exploitation: Shifting from "Technical Novelty" to "Risk Combinations"Another finding in the report is that threat actors often do not distinguish between new and old vulnerabilities when exploiting them. Whether it is a newly disclosed high-risk vulnerability or an old one that has existed for years, attackers adopt the same post-exploitation tactics. This means that, for enterprises, whether a vulnerability has been weaponized and is actually exposed on the attack path is more valuable as a reference than the vulnerability's own base score. For example, among vulnerabilities that are both network-reachable and unauthenticated, the risk posed by remote code execution is particularly prominent. Behind this trend is that attackers prefer to take the path of least resistance—using conventional methods rather than seeking complex exploit chains.

AI's "Real Role": Assistance, Not Replacement

In H1 2026, the application of AI in the attack domain became more visible, but Insikt Group's assessment is that the vast majority of these phenomena still remain at Levels 1 to 3 of Recorded Future's AI Malware Maturity Model (AIM3), namely the "experimentation, adoption, and optimization" stages. AI is increasingly used to solve specific problems, such as helping malware understand UI elements on screen to strengthen persistence (e.g., PromptSpy malware), or using LLMs to generate decoy logic to interfere with security analysts (e.g., the CANFAIL campaign targeting Ukrainian organizations), rather than having AI directly decide the entire attack flow.

At the same time, AI-assisted vulnerability research is amplifying pressure on defenders. The report mentions that the release of the Claude Mythos Preview model appears to have pushed up the number of vulnerability submissions: in June, NVD disclosures were 43% higher than the average of the previous six months. Mozilla also reported that the model helped fix 271 vulnerabilities in Firefox 150, whereas only 22 had been fixed with the previous generation model. The explosive growth of vulnerability information means security teams must more quickly determine which vulnerabilities are truly worth investing effort in.

Supply Chain and Mobile: Neglected Entry Points

Supply chain attacks continue to spread along developer environments, package managers, and AI toolchains. Attackers enter downstream cloud and software ecosystems through stolen credentials, trusted integrations, and software distribution channels. In addition, the H1 2026 report also mentions Magecart attacks that "borrow" trusted third-party services to inject malicious code into checkout processes. On the mobile side, the emergence of NFC malware marks a new stage in mobile payment security—they no longer attempt to obtain one-time passwords through phishing, but instead directly hijack NFC communications, allowing attackers to relay transactions or even withdraw cash from ATMs.

Enterprise Impact Analysis: Risk Is Spreading to Every Business Segment

Operational Risk: Backup and Recovery Capabilities Put to the TestThe report specifically noted that ransomware operators in H1 2026 adopted techniques to "reduce victims' recovery options," meaning enterprises cannot rely solely on on-premises backups; they must also focus on offline, immutable backups and comprehensive recovery drills. The issue of attackers exploiting misconfigured enterprise cloud storage or abusing third-party tools (such as s5cmd) to access backup data is also worth attention.

Compliance and Supply Chain Risk: Third Parties Are No Longer Just a "Compliance Form"

When attackers enter systems through package managers, AI plugins, or open-source components, enterprises' third-party risk management and software supply chain review must be upgraded from "one-time penetration testing" to continuous monitoring. At the same time, regulatory requirements on sensitive data breaches will subject leaks caused by NFC or payment attacks to stricter compliance review and further increase the likelihood of brand reputation damage.

Brand and Trust Risk: Silent "Normal Activity" Is the Hardest to Defend Against

Because attackers go to great lengths to blend into "normal traffic," enterprises may experience long dwell times. By the time detection eventually occurs, attackers may have already completed lateral movement and data exfiltration. Such incidents usually hit customer trust and brand reputation far harder than expected—especially when the cause of the security incident is "the automated tools we trusted were abused."

Industry Trend Observations: Moving Beyond the "Isolated Incident" Narrative

Comparing H1 2026 with past situations reveals a clear long-term trend: attackers are systematically exploiting the "trust anchors" in enterprise ecosystems. Whether in developer environments, remote access tools, NFC payments, or AI assistant plugins, attackers have built their expansion on "using permitted tools."

AI is not without risk. Although fully autonomous attack agents have not yet emerged, the Hugging Face incident in July 2026 has demonstrated the possibility of autonomous agents completing discovery, validation, weaponization, and exploitation with limited human intervention. Defenders must consider how to automate security processes as well, so they can race against machine-speed attack development.

Defense and Response Recommendations: From Point Controls to Comprehensive Defense Across the Attack Chain

In response to the above trends, enterprise security decision-makers should prioritize the following measures:1. Strengthen exposure management: Prioritize patching remote code execution vulnerabilities that are network-reachable and require no authentication, rather than relying solely on severity scores.

2. Drive identity and credential governance: Enable MFA for developers, operations staff, and third-party personnel, with particular focus on accounts linked to cloud environments and package manager credentials.

3. Adopt behavioral detection: Create detection rules in SIEM/EDR/XDR for suspicious behavior involving trusted tools, such as PsExec execution on unexpected hosts, anomalous new AnyDesk connections, and s5cmd listing of high-traffic object storage.

4. Harden development environments: Review AI tool extensions, open-source libraries, and package dependencies; deploy software bills of materials (SBOMs); and monitor suspicious repositories or installers.

5. Improve backup resilience: Implement immutable backups and periodic recovery testing, and ensure critical backups do not share permissions with the production environment.

6. Secure mobile payments: Enable device compliance policies on corporate devices, prohibit jailbreaking, restrict NFC app permissions, and provide dedicated devices or wallet controls for employees who use NFC for payments.

7. Prepare for defense automation in the AI era: Build the capability to automatically rank and patch vulnerabilities using threat intelligence, easing the pressure from surges in vulnerability reports.