Cloud and Software-as-a-Service (SaaS) environments have become top targets for cyber-threat actors this year, according to a new report by Darktrace.
The cybersecurity firm noted that H1 2026 saw a continuation of an evolution observed in 2025 where attackers shifted away from malware and vulnerability exploitation towards compromising identities.
However, whereas in 2025 threat actors primarily targeted account credentials, the first half of 2026 has seen attacks extend to email authentication, cloud entitlements, software supply chains, AI gateways, remote administration tooling and non-human identities. Darktrace said this trend makes “trust” the new attack surface.
Compromised cloud and SaaS environments in particular provide enormous opportunities for attackers.
In one case highlighted by Darktrace, a single compromised SaaS account led to malicious activity across email, SaaS and network layers, such as inbox rule changes and the launch of phishing attacks. This type of attack is difficult to detect as none of the indicators were decisive in isolation, but together represented a clear intrusion.
The vendor also cited several cases where attackers exploited trusted digital supply chain infrastructure used by victims in H1 2026. This included threat actors in April hijacking Axios to spread remote access trojans (RATs). Axios is a JavaScript library downloaded over 100 million times a week and used as a dependency in countless developer environments and CI/CD pipelines.
Atatckers were also observed abusing legitimate blockchain infrastructure to distribute infostealers, including AMOS and Phexia. The researchers noted that such services are frequently used by users with limited security resources and often enable malicious actors to reach a far wider victim base.
“Increasingly, attackers do not need to bypass trust controls in these environments; they inherit them through compromised identities, delegated access, and legitimate administration tools,” the researchers noted in the report published on August 3.
Email Attacks Prioritize Quality Over Quantity
The study found that email-based attacks are growing in sophistication, with attackers investing in quality over “noise.”
Around two-thirds of phishing emails sent in H1 2026 passed the DMARC email validation protocols, which the researchers said show that authentication is no longer sufficient to protect accounts.
More than a third (37%) of phishing attacks contained a high volume of text in H1 2026, up from 32% in the same period in 2025.
In addition, 39% of phishing featured novel social engineering techniques and VIP users were targeted in 25% of observed attacks. This suggests that threat actors are increasingly customizing attacks to specific targets.
ClickFix social engineering, a technique designed to trick users into running malicious code themselves, continued to be a common attack vector from 2025.
AI is Growing the Attack Surface
The growing use of AI in enterprises has significantly expanded opportunities for cyber attackers, according to the Darktrace study.
This includes threat actors leveraging AI tools to launch attacks at scale. This was demonstrated with the use of AI-generated malware exploiting the React2Shell vulnerability, in which an attacker used an LLM to produce working exploit code and deploy it at scale.
In July, the world’s first fully AI-generated ransomware campaign, dubbed JadePuffer, was highlighted by security researchers. An agentic threat actor exploited a vulnerability in an internet-facing server before launching a fully automated ransomware attack.
“AI is accelerating the path from vulnerability disclosure to operational exploitation,” the Darktrace researchers wrote.
