2026 Cyberthreat forecast: What lies ahead

The 2026 threat landscape represents more than incremental evolution. It signals a fundamental realignment of the attacker-defender balance.

The threats detailed herein — from ClickFix mutations to API abuse, deepfakes to supply chain poisoning — share a common DNA: they exploit the fundamental asymmetry between attacker innovation and defender scalability. While organizations implement security controls designed for yesterday’s threats, adversaries orchestrate attacks optimized for tomorrow’s landscape.

An evolving ClickFix. A growing threat.

ClickFix emerged in late 2023, using fake pop-ups or CAPTCHA prompts to trick victims into copying malicious commands from the clipboard into system consoles like PowerShell. Its techniques rely on the usage of the Win+R shortcut, which opens Windows Run Dialog to execute a command. We have seen a rapid evolution of this TTP since then, with new social engineering tricks emerging every week, and new LOLBins adapted by adversaries. Currently, this is the most common Initial Access method for workstations’ initial infections.

One of its variants, FileFix, emerged in late June 2025 and refined the concept by leveraging File Explorer’s address bar for execution. This reduced user’s suspicions and increased defense-evasion values of the method. We’ve already seen this technique in action.

Both techniques rely on trusted OS features and imitate normal users’ behaviors (a code executed from Explorer.exe parent process). This makes detection challenging and helps evade defense. Their evolution highlights a shift toward human-assisted execution.

The alarmingly high success rate of this simple yet effective attack has led to the conclusion that, in 2026, we should expect new variants and alternatives being tested by threat actors.

*Defender hint: It is critical to monitor what goes through your RunMRU Registry Keys.

API abuse on the rise

In 2026, API abuse will emerge as one of the most critical cybersecurity threats.

This attack surface will keep expanding dramatically as organizations increasingly adopt hybrid architectures by integrating SaaS platforms, multi-cloud environments, third-party microservices and AI-driven solutions at large scale. APIs, which serve as the backbone for many of these integrations, will become one of prime targets for adversaries.

Factors that make this target highly attractive to threat actors include:

Weak authentication – In practice, API access is often maintained based on a pair of client ID and secret key (no 2FA as it is for human accounts).
Insufficient monitoring – Activities performed with the usage of API still do not generate significant telemetry in defender’s systems. The recent addition of GraphAPIAuditEvents table in Microsoft XDR’s Advanced Hunting is definitely a step in the right direction.
Excessive permissions – The number and complexity of rights that can be granted might be overwhelming and results in overextended rights given for API access.
High exposure – In many cases, APIs are designed to be accessible over the Internet and this is very beneficial from a threat actor’s perspective.
Hardcoded credentials in developer’s code, undocumented API endpoints or lack of proper understanding of risk by defenders – These are few more aspects that might raise additional API-related security concerns.

We’ve already seen many examples of devastating nation-state attacks where API was one of the key weapons used by threat actors against their victims, such as the famous SolarWinds compromise from 2020, and 2023 when Midnight Blizzard breached Microsoft’s EntraID production tenant. While such attacks still require a bit more maturity from the attackers, the rapid evolution of financially motivated threat actors suggests it’s only a matter of time before they adapt similar capabilities at scale.

Threat actors in the theatre of deepfake

Social engineering is the oldest attack technique, with roots that go back way far before the digital era and will extend far beyond it too. Now, while almost every headline contains AI, social engineering gains devastating operational weapon – deepfakes. The exponential trajectory of Generative AI (GenAI) growth signals wider, faster adaptation of deepfake by adversaries. Organized cybercriminal groups such as UNC6040, BlackBasta and Lazarus Group now integrate voice cloning directly into ransomware operations, business email compromise (BEC) campaigns or espionage, creating hybrid attacks combining automation with unprecedented social engineering effectiveness.

The next years paved the road for deepfakes with dangerous new trends and innovative techniques:

Hyper-realistic synthesis: Audio and video deepfakes increasingly pass human scrutiny, especially under time pressure and authority cues.
Deepfake-as-a-Service (DaaS): Commoditized platforms have democratized enterprise-grade fraud capabilities for low-skill actors at minimal cost.
Multi-vector convergence: Deepfakes merge with synthetic identities, social engineering, multi-profile browsers, emulators, and coordinated bots to appear as legitimate users at scale.

The evolution from isolated phishing emails to coordinated, multi-channel campaigns featuring deepfake impersonation represents a qualitative shift in social engineering that existing security frameworks need to adapt to.

New EDR tampering methods

We, as a Cybersecurity community, saw how the wide adoption of EDR technology and behavioral-based detection changed the rules of the game drastically in the last few years. While, from a defender’s perspective, it quickly turned out to be the most important component helping to stop these more mature threat actors, for adversaries it became a thorn in the side.

They had to come up with new ways to help them avoid being flagged by EDRs, for example by tampering EDR agent functionality. One of the most successfully adapted category of tools for this purpose are EDR killers. We’ve already seen this type of tooling in the hands of Russian APTs in large-scale operation (where they used the tool EDRSandblast) but different variants of EDR Killer also quickly became a very important weapon in the arsenal of different ransomware groups. At the heart of each tool is the same – Bring Your Own Driver: BYOVD, a legitimate, signed but vulnerable driver giving adversaries low-level system access. Over the time, defenders have learned how to leverage this to counter EDR killers effectively.

No groundbreaking discoveries have appeared since then, with the one exception for an EDR freeze in September 2025, which drew considerable attention across the industry, highlighting the appetite for novelty. This stagnation y updates suggests that threat actors are under pressure to devise new methods to tamper with EDRs and maintain an operational advantage.

The modern cloud-native ransomware strategy bypasses traditional endpoint defenses by targeting cloud storage and backup APIs.

The attacks on supply chain via package managers

In September 2025, the cybersecurity world observed Shai-Hulud: NPM malware that incorporated additional novel self-propagation capabilities. It was leveraging tools such as TruffleHog to steal credentials, infiltrate further and increase scale of the infection.

By late November 2025, we observed a second variant: Shai-Hulud 2.0, also dubbed “The Second Coming”. The successor is even more aggressive with new features like destructive fallback mechanism. We already know that the scale of this propagation is a few times larger than the last. It is clear that malware authors used experience gathered during the previous wave of Shai-Hulud in order to get better.

All of that shows that threat actors learn how to leverage one of the key components of modern software development – open source packages. Increasing automation in CI/CD pipelines and the lack of dependencies checks, both pose a significant security threat.
JavaScript’s NPM is right now a prime target for attackers, but in 2026 we should expect a similar type of attack and their evolution for different package ecosystems, such as Python’s PyPI, Java’s Maven or VSCode’s extension market.

AI on a digital warpath

AI has transformed cyberattacks into more automated and available weapons. Nation-state actors and cybercriminals now deploy AI to generate convincing phishing emails, create deepfake audio and video amplifying social engineering potential, and develop polymorphic malware that rewrites itself to evade detection.

Malicious LLM tools like WormGPT, FraudGPT, KawaiiGPT, DarkBERT, XXXGPT and Wolf GPT, usage of commercial AI (GTIG reports the use of Gemini by APT42), generative AI-powered social engineering, automating operations of RaaS, and malware generation or vibe-coding are just some examples of how AI has been leveraged by adversaries.

In our forecast for 2026, we don’t want to cite any figures or envision new AI-powered mutation of TTPs. Instead, we’d like to remind you that adversaries use AI to accelerate, automate and scale up their operations in a very similar way that we use AI for defense.

The question is not whether AI will dominate the cybersecurity arena. It already does.
The question is who will master it first?

The way ahead

The uncomfortable truth is that most organizations reading this forecast are already behind the threat curve. The margin between current defenses and future threats is measured in months, not years. Defenders must fundamentally reimagine their approach.

Here’s how you can get started:

Abandon reactive security. Preemptive threat hunting, adversarial simulation, and assumption-of-compromise frameworks are no longer optional; they are baseline expectations.
AI is not a future capability; it is the present prerequisite. Organizations deploying AI-powered detection, threat intelligence, and autonomous response will survive.
Recognize that supply chains, APIs, and human cognition are permanent attack surfaces.

The transformation has already begun. Will your organization lead it or be consumed by it?

Let’s connect and discuss cybersecurity trends shaping your industry and how prepared you are for 2026 and beyond.