Attackers Only Need 48 Hours: A Summary of the CrowdStrike Threat Hunting Report 2026

48 hours. That’s all attackers need — in 88% of cases, a vulnerability with a publicly available exploit is attacked within two days of the exploit’s release. That’s one of the key findings of the brand-new CrowdStrike Threat Hunting Report 2026. In today’s Security Sunday, we look at why a modern attack no longer looks like an attack, but like an ordinary login. Plus: a leak of Trezor customer data via a logistics partner, the Dysphoria botnet with 296,000 hijacked devices, and Apple warning users about spyware in 110 countries.

On August 3, CrowdStrike released its annual Threat Hunting Report — 59 pages built on data covering the period from July 2025 to June 2026. The OverWatch team behind the report analyzes 7 trillion security events per day, so this isn’t armchair theorizing. These are numbers from real intrusions at real companies.

We read the whole thing for you. And we picked out what we believe every Czech and Slovak company should know — whether you manufacture, heal, or manage money.

The year attackers stopped storming the front door

Intrusion volume grew by just 4 percent year over year. That almost sounds like good news, especially after last year’s 27 percent increase. Except it isn’t. Attackers haven’t slowed down — they’ve matured. Instead of mass, noisy “try everything on everyone” campaigns, they’re investing in more deliberate attacks with more creative entry points.

The common denominator of the entire report is the abuse of trust. Trust in the software you download. In the IT colleague who calls you. In a login screen that looks just like yours. Attackers no longer break through a hardened perimeter. They come in through paths you trust so much that nobody watches them.

Motivation splits roughly in half: 56 percent of intrusions are the work of cybercrime, 44 percent of state-sponsored groups. The technology sector is the most frequent target for the ninth year in a row, but the biggest year-over-year increases were recorded in finance (+11%) and academia (+17%).

One number from this section deserves a separate mention: the North Korean group FAMOUS CHOLLIMA, known for infiltrating companies with fake IT workers, was responsible for 55 percent of all state-sponsored intrusions.

From vulnerability disclosure to attack in two days

The most important statistic of the entire report: 88 percent of cases involving the exploitation of a vulnerability with a publicly available exploit occurred within 48 hours of the exploit’s publication.

Two examples stand for all. The critical React2Shell flaw in Next.js applications was disclosed on December 3, 2025, together with a patch. Within 24 hours, it was being actively exploited by the Chinese groups VAULT PANDA and GENESIS PANDA. In fact, during the first four days, OverWatch handled over 800 traces of suspicious exploitation across more than 80 victims.

The second example: the Linux flaw CopyFail. The exploit was released on April 29, 2026, and a mere 20 hours later the Belarusian group UMBRAL BISON deployed it against a Ukrainian government institution.

The window between vulnerability disclosure and attack is not going to widen — it will keep closing.

Supply chain

According to the report, supply chain attacks reached a tipping point this year. The npm package ecosystem, which practically every modern web project draws from, accounted for 87 percent of all malicious packages caught in the first half of 2026.

Two groups demonstrated where this type of attack has moved. The criminal group ALTERED SPIDER compromised over 300 software dependencies in a single day. Its malware is designed to spread on its own. It steals a package maintainer’s credentials and uses them to infect additional packages, with no operator involvement. The same group also poisoned a popular GitHub Action for the Trivy tool, so credential-stealing malicious code was executed directly by the CI/CD pipelines of companies that trusted it.

North Korea’s STARDUST CHOLLIMA, in turn, showed that a technically sophisticated supply chain attack often begins with plain old human manipulation. In June 2026, it inserted a malicious dependency into 131 packages of the Mastra AI framework — and it all started with the attacker approaching a Mastra employee on LinkedIn and getting them to click a malicious link during a video call.

In this context, the report calls the AI ecosystem the next battleground for supply chain attacks. AI development environments, SDKs, and agentic frameworks contain cloud credentials, API tokens, and access to compute infrastructure — exactly what attackers are after.

Vishing

Fraudulent phone calls as an entry point into companies are growing steeply: the first half of 2026 brought twice as many vishing intrusions as the second half of 2025.

The typical scenario looks like this. “IT support” calls you, needs to fix a trivial technical issue, and steers you to a login page on your personal phone — a device the company doesn’t manage and the security team can’t see. The page looks exactly like your corporate SSO. You enter your username, password, and MFA code. The attacker then registers their own device for two-factor authentication and gains persistent access.

And from there, things move fast. In one documented case, the group SNARKY SPIDER went from account takeover to downloading corporate data from cloud applications in less than five minutes. No malware, no lateral movement, no privilege escalation. Just valid credentials and a direct path to the data.

But there is an encouraging part too: these attacks leave traces that can be caught. Logins from proxies, mass file downloads, registrations of suspicious MFA devices. When an Android emulator logs into your corporate SSO, that’s not normal traffic — and it never will be.

Cloud

Criminal activity targeting the cloud grew by 171 percent over the reporting period. And it makes sense. Companies today are moving money, data, and infrastructure to the cloud, and attackers are following them.

The fastest-growing technique is so-called device code phishing. The attacker abuses a legitimate sign-in mechanism (you know it, for example, from signing in to apps on your TV) and obtains a valid access token without the victim ever entering a password into a suspicious page. The monthly volume of these attempts grew fifteenfold over the past six months, mainly thanks to commercial phishing-as-a-service platforms.

The report also describes newer monetization methods. So-called LLMJacking — the abuse of a company’s access to AI models. The report mentions a case where an attacker sent nearly 200,000 API requests through a compromised cloud account within the first two minutes. The victim pays for them, of course. The classic — mining cryptocurrency at someone else’s expense — hasn’t disappeared either. In one case, an attacker mined roughly $41,000 worth of cryptocurrency on a US technology company’s account.

Why is this such a great attack vector? An attacker inside the cloud with valid credentials doesn’t look like an attacker. Every API call appears legitimate. Only the attacker’s behavior gives away the malicious intent. That’s why it’s important to build security monitoring in the cloud as well — and to test it regularly.

When the attack comes through a hotel room

The most readable chapter of the report concerns the Chinese group OVERCAST PANDA. It doesn’t use phishing or vulnerabilities. It gets to its targets’ laptops physically.

The pattern is similar every time. A manager or specialist travels to a conference in China, leaves their laptop in the hotel room in the evening, and goes to dinner. The documented compromise times match the evening programs of the conferences exactly. The attacker boots the device from USB — bypassing the running operating system and all security tools — and installs the FlowCloud backdoor. The owner returns, turns on the laptop, and notices nothing.

Targets included, among others, employees of a US biotechnology firm and journalists from foreign media outlets. The lesson for every company is simple: disk encryption, BIOS passwords, and above all the rule that a laptop with company know-how never stays unattended.

What to take away from the report

After reading the report, I arrived at five priorities:

Map what you have exposed to the internet, and have an emergency patching process for those systems measured in hours. Not for everything — just for what’s visible from the outside. Most companies we test don’t even have the list.
Deploy phishing-resistant MFA and monitor new MFA device registrations. SMS codes and push notifications won’t stop an attack via a spoofed login page. FIDO2 keys will — but even there, watch out for downgrade attacks.
Tell your employees that IT will never call them about their sign-in settings.
Secure development environments and CI/CD. Dependency checks, code signing, protection of package maintainer accounts. And assume that AI tools in development are a new attack surface, not just a productivity booster.
Treat AI systems like critical infrastructure. Inventory your models, API keys, and agents; enforce least privilege; monitor. An unexpected cloud bill may be the first symptom of an intrusion.

For companies covered by NIS2, most of this is mandatory anyway. The report just shows that these are not paper regulations — every one of these points corresponds to a real technique attackers are actively using this year.

Conclusion

One idea runs through the entire report: a modern attack doesn’t look like an attack. It looks like an employee login, a package installation, an API call, a phone call from IT support. The difference between legitimate traffic and an intrusion often comes down to context and speed — which is exactly why relying on monitoring or a SIEM to catch something on its own is no longer enough.

The best way to find out whether your company would withstand such an attack is to try it out safely. A penetration test shows you what you have exposed and exploitable. A phishing simulation tests how your people respond to manipulation by email and by phone. And red teaming tests the entire chain — from first contact to your team’s response — exactly the way a real attacker would.

Test your company before hackers do.