Q2 2026The Threat Landscape in Review

The second quarter of 2026 was defined by attacks on trust. Across April, May and June, the most consequential incidents did not involve attackers battering at hardened perimeters. They involved attackers walking in through the software supply chain, the identity plane, and third-party providers that their victims had every reason to trust.

Running underneath almost every story was artificial intelligence, which moved decisively from an emerging concern to an operational reality on both sides of the fight. Anthropic disclosed that a frontier model could autonomously discover and exploit previously unknown vulnerabilities, the FBI dismantled an AI-assisted phishing service blamed for 1.9 billion US dollars in losses, and by June the US government was forcing AI companies to restrict access to their most capable models. Regulators, from Australia's APRA and ASD to the Five Eyes agencies collectively, spent the quarter telling boards that this is a present business risk, not a future one.

Five interconnected themes ran through the quarter:

1. AI became the weapon, the shield and the thing being regulated, all at once. Frontier models demonstrated offensive capability, criminals industrialised AI-assisted fraud, and governments began treating access to the most capable models as a national security matter.
2. The software supply chain trust model cracked open. Signed, provenance-verified npm packages shipped malware, and attackers repeatedly reached their targets by compromising the pipelines and third parties that produce and deliver trusted software.
3. Identity was the dominant breach vector. The ShinyHunters collective and the broader network known as The Com dominated the headlines, exploiting stolen credentials, OAuth abuse, social engineering and a platform zero-day to compromise hundreds of organisations.
4. Nation-state activity shifted toward pre-positioning and disruption. Iran targeted exposed industrial control systems, China moved to covert networks built on compromised edge devices, and CISA formally moved US critical infrastructure policy onto a wartime footing.
5. Australian regulators accelerated hard. The quarter brought an APRA letter on AI risk, the retirement of the Essential Eight, an update to the Information Security Manual, a new Cyber Incident Review Board and the 89.3 million dollar Horizon 2 phase of the national strategy.

Artificial intelligence dominated the quarter in three distinct roles: as an offensive weapon, as a defensive tool, and as a subject of urgent regulation. The three roles kept colliding.

In April, Anthropic published a technical assessment of its most capable model, Claude Mythos Preview, disclosing that during internal testing the model had autonomously discovered and exploited previously unknown vulnerabilities across every major operating system and web browser. In one documented case it chained four separate vulnerabilities to escape the security boundaries of both a browser and the underlying operating system, a level of sophistication historically associated with nation-state programmes. The model found a 27-year-old flaw in OpenBSD and a 17-year-old remote code execution flaw in FreeBSD, autonomously, in hours. Rather than release the model publicly, Anthropic launched Project Glasswing, a controlled consortium of defenders including AWS, Apple, Microsoft, Google, CrowdStrike and JPMorgan Chase, and estimated that comparable capabilities would emerge from other labs within six to eighteen months.

By June the criminal application was visible. Working with Google and Black Lotus Labs, the FBI dismantled ‘Outsider Enterprise’, a China-based phishing-as-a-service operation running since at least 2023 that combined AI with distributed phishing kits to impersonate trusted brands over the major US carriers. The operation was tied to roughly 9,000 fake sites, more than a million fraudulent URLs, the theft of over 3.8 million credit card records, and an estimated 1.9 billion US dollars in losses.

The offensive capability quickly became a governance problem. In June the US government forced Anthropic to suspend access to its two most advanced models, Fable 5 and Mythos 5, for all customers worldwide, citing a jailbreak that could turn the models toward finding software vulnerabilities. Anthropic disputed the basis for the order, describing the evidence as a narrow, non-universal jailbreak, but complied globally rather than attempt to partition access by nationality. Days later OpenAI delayed the full public release of GPT-5.6 at the US government's request, limiting access to a small group of vetted partners. Both episodes signalled that access to frontier models is now being treated as a national security control point.

Defensively, the message from every major agency was the same: adopt AI deliberately or fall behind. In June the Five Eyes cyber security agencies issued a joint statement warning that AI is accelerating the speed, scale and sophistication of attacks, shrinking the window between a vulnerability being discovered and exploited, and that this is now a core business risk and a leadership responsibility rather than a purely technical one. The UK's NCSC had already warned in early May of an AI-fuelled "patch tsunami", in which AI-driven vulnerability discovery flushes out years of accumulated technical debt faster than most security teams can absorb it.

Identity was the battleground of the quarter, and one name recurred more than any other. ShinyHunters, an English-speaking group active since 2019 and closely intertwined with Scattered Spider inside the broader criminal network known as The Com, dominated the breach headlines from April through June.

The group's relevance to Australia is direct. It was behind the July 2025 Qantas breach that exposed data on roughly 5.7 million customers. In April 2026 there was a genuine law enforcement win when Tyler Buchanan, a 24-year-old operating as "Tylerb", pleaded guilty in a California federal court in connection with his role in Scattered Spider, facing sentencing in August. But as analysts noted, when individual members are arrested others fill the roles, and the operation did not slow.

April alone brought ShinyHunters breaches of Rockstar Games, Udemy and others, several traced to a shared third-party cloud access pathway. In May the group ran a sustained two-week extortion campaign against Instructure, exploiting an undisclosed flaw in the Canvas learning platform and claiming exfiltration of roughly 3.65 TB of data affecting approximately 275 million individuals across nearly 9,000 institutions. Much of the exposed data belonged to minors, which, unlike passwords or card numbers, cannot be rotated. Instructure ultimately announced it had "reached an agreement" with the attackers, language widely read as a thinly veiled confirmation of a reported 10 million US dollar payment.

By June the group had shifted technique again, exploiting CVE-2026-35273, a critical unauthenticated remote code execution zero-day in Oracle PeopleSoft, to compromise more than 100 organisations between late May and early June. Around 68% of the victims were universities and colleges. The broader lesson of the quarter is that ShinyHunters' tradecraft, OAuth token theft from vendors, insider recruitment and zero-day exploitation, is being copied across the ecosystem faster than most organisations are adapting to it.

Domestically, the quarter was one of unusually concentrated regulatory activity, much of it explicitly connected to the AI developments overseas.

Several advisories issued during the quarter warrant prompt attention. Organisations should confirm their exposure to each and prioritise remediation of internet-facing systems.