Why Cloud and SaaS Environments Are Under Siege
The first half of 2026 has made one thing painfully clear: cloud and SaaS environments are now the primary playground for cybercriminals. That’s the central finding from Darktrace‘s latest threat report, published on August 3.
The shift didn’t happen overnight. Throughout 2025, attackers gradually moved away from traditional malware and vulnerability exploitation. Instead, they zeroed in on one thing: identities. But the game has changed again. In H1 2026, the focus has expanded beyond simple account credentials to email authentication, cloud entitlements, software supply chains, AI gateways, remote admin tools, and non-human identities.
The result? Trust itself has become the attack surface.
A Single Compromised SaaS Account Can Wreak Havoc
Darktrace highlighted a case where one compromised SaaS account triggered malicious activity across email, SaaS, and network layers simultaneously. Attackers changed inbox rules and launched phishing campaigns. Individually, none of these actions looked suspicious. Together, they spelled a clear intrusion.
That’s the scary part. These attacks are designed to fly under the radar, blending in with normal user behavior.
Supply Chain Attacks: Hijacking Trusted Infrastructure
The report also detailed how attackers are exploiting trusted digital supply chain infrastructure. In April, threat actors hijacked Axios — a JavaScript library downloaded over 100 million times weekly — to distribute remote access trojans (RATs). Axios is a dependency in countless developer environments and CI/CD pipelines, making it a perfect delivery vehicle.
Blockchain infrastructure hasn’t been spared either. Researchers observed attackers abusing legitimate blockchain services to spread infostealers like AMOS and Phexia. These platforms often serve users with limited security resources, giving malicious actors access to a much wider victim base.
“Increasingly, attackers do not need to bypass trust controls in these environments; they inherit them through compromised identities, delegated access, and legitimate administration tools,” the researchers noted.
Email Attacks Get Smarter, Not Louder
Email-based attacks are evolving too, but not in the way you might expect. The focus has shifted from quantity to quality.
Around two-thirds of phishing emails in H1 2026 passed DMARC validation protocols. That’s a sobering stat — it means authentication alone can no longer protect your inbox.
- 37% of phishing attacks contained a high volume of text, up from 32% in H1 2025
- 39% featured novel social engineering techniques
- VIP users were targeted in 25% of observed attacks
These numbers paint a picture of attackers customizing their campaigns for specific targets. They’re doing their homework, and it shows.
ClickFix social engineering — a technique that tricks users into running malicious code themselves — continued its run from 2025 as a common vector.
AI Is Expanding the Attack Surface
The rise of AI in enterprise environments has opened new doors for attackers, and they’re walking right through them.
One notable example: AI-generated malware exploiting the React2Shell vulnerability. An attacker used a large language model to produce working exploit code and deployed it at scale. No manual coding required.
Then there’s JadePuffer, the world’s first fully AI-generated ransomware campaign, highlighted by researchers in July. An agentic threat actor exploited a vulnerability in an internet-facing server before launching a fully automated ransomware attack.
“AI is accelerating the path from vulnerability disclosure to operational exploitation,” the Darktrace researchers wrote.
What This Means for Your Security Strategy
If you’re still treating cloud and SaaS environments as secondary concerns, it’s time to rethink. The attackers have already made their move.
Focus on identity protection, monitor for anomalous behavior across all layers, and don’t rely solely on authentication protocols. The threat landscape has shifted — your defenses need to shift with it.
