The security company CrowdStrike documents in its current Threat Hunting Report targeted attacks on corporate access to AI services. In a case recorded in May 2026, a group of attackers sent around 200,000 requests within two minutes via a compromised account before automatic throttling intervened.
Compromised accounts cause request floods
The report refers to the phenomenon as “LLMjacking”: attackers steal access credentials to corporate accounts with AI providers and use the unlocked quotas for their own purposes, such as automatically sending requests to language models. In the documented May case, an attacker first escalated a compromised identity to administrative rights and then submitted matching usage forms before the flood of requests began. CrowdStrike’s observation team OverWatch also recorded a prepared configuration of a Model-Context-Protocol server in a honeypot trap during the reporting period, designed specifically to capture environment variables and the credentials stored within them. Attack techniques that directly target access to AI models accounted for 16 percent of the observed attack patterns in the relevant assessment framework MITRE ATLAS. Adam Meyers, who leads adversary-activity monitoring at CrowdStrike, explains that companies must secure AI systems as consistently as they roll them out. The report also places account hijacking within a broader identity-theft trend: vishing calls demanding credentials doubled in the first half of 2026 compared with the second half of 2025, while device-code phishing attempts rose fifteenfold within six months. For the group known as Snarky Spider, the path from account takeover to data exfiltration sometimes took less than five minutes.
North Korean group hijacks AI framework via npm
In parallel, the report describes a supply chain attack on the open-source AI agent framework Mastra. The North Korean group Stardust Chollima, also known as Sapphire Sleet, gained access to a Mastra contributor’s publishing account through social engineering on LinkedIn, according to Microsoft. On June 16, 2026, the attackers first uploaded an inconspicuous test version of malware disguised as a date library called “easy-day-js.” A day later they released the actual attack stage and, within twenty minutes, added it as a dependency to more than 140 packages in the Mastra namespace. The malware disabled TLS certificate verification, downloaded a second-stage payload, and installed itself persistently on Windows, Mac, and Linux machines, where it harvested cryptocurrency wallets and browser data, among other things. The affected packages typically run on developer machines, in automated build systems, and in production AI services – exactly where access keys to language models also live. The same group had already compromised the npm package Axios in March 2026 using a maintainer’s stolen credentials. According to CrowdStrike’s observations, its campaigns primarily target financial service providers, cryptocurrency firms, and venture capital investors. npm removed the compromised versions and revoked the group’s publishing rights once the attack was discovered.
Attack windows shrink significantly across industries
Beyond the two AI cases, CrowdStrike registers shorter response times from attackers across industries generally. 88 percent of all publicly available exploit code examples were actively used within 48 hours of becoming known. Exploitation of newly discovered zero-day vulnerabilities rose 42 percent year over year. Malicious npm packages accounted for 87 percent of all threats found in software registries in the first half of 2026. Cloud-heavy attacks climbed 171 percent. The technology sector remains the most frequently targeted industry for the ninth consecutive year, while financial services and academic institutions logged the strongest increases. CrowdStrike’s more than 290 tracked adversary groups now trigger automated alerts 2.5 times more often than cases involving direct human intervention. A case already covered on beckmann.ai in July, in which a compromised Jscrambler package specifically harvested API keys from AI coding tools like Claude Desktop and Cursor, fits the same pattern.
Whether companies will start monitoring their AI accounts as closely as traditional user accounts, or whether attackers stay a step ahead of the faster response times, remains an open question. CrowdStrike, together with AWS, announced a red-teaming competition for securing AI agents starting August 31, 2026 – a first concrete test of whether the gaps described in the report can be closed in practice.
