Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Security teams are not struggling to find vulnerabilities. They are struggling to deal with them in a way that actually reduces risk. Most environments generate thousands of new findings every month. While vulnerability scanners, cloud tools, and endpoint platforms all contribute, that data does not come together in a way that is actionable. Teams end up with long lists of vulnerabilities, limited context, and no clear way to determine what should be fixed first.

The 2026 FIFA World Cup is a once-in-a-generation opportunity, and threat actors have already begun capitalizing on it. The 2026 FIFA World Cup, set to kick off on June 11, has already broken records for the most host nations, the most matches, and the highest amount of prize money to date for winning teams. Arctic Wolf set out to proactively investigate the criminal ecosystem surrounding the tournament.

The conversation around AI in cybersecurity is changing. The first question was whether AI could help security teams move faster. It can. AI-led security operations can accelerate investigations, correlate signals, reduce manual work, and help defenders respond at the speed modern threats demand. But as AI moves from experimentation into production, the next question becomes harder: can organizations operate it at scale without creating a new cost problem?

Mobile devices are becoming the highest‑trusted endpoints that are the least protected. They approve logins. They hold authentication apps. They carry email, collaboration, and business applications. And they travel everywhere your workforce travels: across corporate networks, home Wi‑Fi, airports, hotels, and cafés. That combination (high trust plus constant movement) is why mobile has become such a reliable entry point for credential theft and account takeover.

In our previous post, Token Bingo: Don’t Let Your Code Be the Winner, we documented Kali365, a phishing-as-a-service (PhaaS) kit abusing Microsoft’s OAuth 2.0 device authorization flow to steal Entra ID tokens. In this follow-up report, we track the same operator into new territory as they expand their operation and infrastructure.

Security teams are being asked to operate at machine speed while still making decisions they can trust. Attackers move faster. Exposure changes continuously. Manual workflows struggle to keep up. Following the recent announcement of the Aurora Superintelligence Platform and Aurora Agentic SOC, Arctic Wolf continues to advance its portfolio with new capabilities that help teams see risk clearly, prioritize what matters, and act with confidence.

In May 2026, Arctic Wolf observed a cluster of malicious activity affecting endpoints managed by FortiClient Endpoint Management Server (EMS). The malicious payload was disguised as a fake Fortinet endpoint patch, but it was actually a credential stealer. We named this payload EKZ Infostealer, based on internal symbol names extracted from decrypted code.

One of the most important shifts AI enables in detection engineering is changing where engineers spend their time. Traditionally, a significant portion of detection development effort is consumed by implementation details: writing complex SQL queries, building enrichment pipelines, handling edge cases, tuning rule logic, writing tests, documenting detections, and repeatedly iterating on detection logic. Those tasks are necessary, but they are also time-consuming.

Across every industry, one thing has become abundantly clear: Cloud security has never been more critical, nor more complex. Organizations are scaling cloud environments faster than ever, but the explosion of identities, configurations, and services has created an attack surface that traditional approaches simply can’t keep up with. Teams are drowning in alerts, struggling to identify which issues matter, and facing increasing pressure to respond to threats with limited resources.

OpenAI recently introduced Daybreak, a cybersecurity initiative designed to apply frontier AI models to vulnerability discovery, secure code analysis, and earlier remediation across the software lifecycle. By combining advanced reasoning and planning capabilities, Daybreak aims to help organizations identify and address weaknesses before they reach production. This is a meaningful step forward, but it is also a continuation of a long-standing approach.