Ankura CTIX FLASH Update – July 22, 2026

Malware Activity

AI-Powered Threats Exploit Cloud Services and Target Critical AI Assets

Recent research highlights a concerning shift in cyber threats as attackers are increasingly leveraging artificial intelligence and trusted cloud platforms to conduct sophisticated operations with minimal human involvement. The JADEPUFFER threat actor demonstrated this evolution by autonomously exploiting vulnerable systems, adapting to obstacles in real time, harvesting cloud credentials, and deploying a specialized ransomware strain known as EncForge. EncForge targets valuable AI assets such as training datasets, model checkpoints, vector databases, and embeddings. At the same time, researchers uncovered HollowGraph, a stealthy malware component that abuses legitimate Microsoft 365 and Microsoft Graph services to communicate with attackers through hidden calendar events. This allowed commands and stolen data to blend in with normal business activity. Both threats rely on strong encryption