Darktrace: 100M-Weekly Axios Downloads Hijacked as Cloud Top Attack Target

Cybersecurity professionals have long prepared for malware and vulnerability exploits, but Darktrace’s new report makes a stark case: the battlefield has moved to the cloud, and your biggest blind spot is trust. In the first half of 2026, attackers didn’t just steal credentials—they turned AI gateways, CI/CD pipelines, and even a ubiquitous JavaScript library into attack highways, leaving signature-based tools blind to the intrusion.

The cybersecurity landscape has undergone a significant transformation in the first half of 2026, with cloud and SaaS environments emerging as the primary targets for sophisticated threat actors. According to a new report by Darktrace, attackers have completed a pivot away from traditional malware and vulnerability exploitation toward a strategy centered on compromising identities. While 2025 saw a heavy focus on stealing account credentials, H1 2026 has witnessed an alarming expansion into email authentication protocols, cloud entitlement abuse, software supply chain corruption, AI gateway infiltration, remote administration tooling, and non-human identities. This shift effectively makes 'trust' the new attack surface, as malicious actors inherit established permissions and legitimate access rather than forcibly bypassing them.

“

Similarly, Darktrace observed the abuse of legitimate blockchain infrastructure to disseminate infostealers like AMOS and Phexia, preying on users who often lack robust security measures.

The implications are profound. In one illustrative case highlighted by Darktrace, a single compromised SaaS account triggered a cascade of malicious activity across email, SaaS applications, and network layers—including inbox rule modifications and internal phishing campaigns. Crucially, none of these individual indicators were severe enough to trip traditional detection mechanisms on their own; only when correlated did they reveal a clear intrusion. This underscores a fundamental challenge for defenders: as attack patterns grow more subtle and span multiple platforms, security teams must evolve from isolated alerting to holistic behavioral analysis.

The threat multiplies further when attackers target the software supply chain. In April 2026, malicious actors hijacked Axios, a widely used JavaScript library downloaded over 100 million times per week, to distribute remote access trojans (RATs). Because Axios is deeply embedded in countless developer environments and CI/CD pipelines, the breach not only infected end-user machines but gave attackers a foothold in the software development lifecycle itself. Similarly, Darktrace observed the abuse of legitimate blockchain infrastructure to disseminate infostealers like AMOS and Phexia, preying on users who often lack robust security measures. These tactics demonstrate a disturbingly efficient model: by compromising a single trusted node—be it a library, a SaaS account, or a blockchain service—attackers can reach an exponentially larger victim base with minimal effort.

Behind these developments lies a broader industrial trend: the rapid adoption of cloud services has expanded the organizational attack perimeter far beyond the traditional network boundary. Businesses now rely on a web of interconnected SaaS applications, APIs, and third-party integrations, each representing a potential trust relationship that can be exploited. Darktrace's observation that attackers no longer need to bypass trust controls but instead inherit them through compromised identities or delegated access is a sobering reminder that the very mechanisms designed to enable seamless collaboration—single sign-on, OAuth tokens, service accounts—are now prime vectors for intrusion.