The Take — AI's ransomware edge is stolen logins, not malware

Every quarter now produces a chart of AI-powered ransomware climbing, and this week's chart said 30 percent. I think the chart is measuring the wrong layer of the attack. At the layer the security industry sells against — payloads, encryptors, endpoint detections — AI is barely helping criminals at all. At the layer almost nobody budgets for, the token that proves a machine or a person is who they claim to be, an agent did in about 34 hours what a crew used to need weeks of work for.

The evidence arrived in the same week and splits almost too neatly. Of 405 AI-linked malware samples that Halcyon tracked this year, 12 reached a protected endpoint, and all 12 were detected, per its Q3 ransomware report. The same report documents AI agents harvesting more than 2,100 Azure AD token sets across 40-plus tenants in roughly a day and a half — not a ransomware payload, a credential harvest, and the one place in the quarter where the automation visibly scaled.

That asymmetry is the whole story of Q3, and it points somewhere uncomfortable: the next ransomware wave will not be stopped by better malware detection, because it will not use malware.

What the 30 percent actually measures

Start with the counts, because they set the frame. ReliaQuest tallied roughly 2,928 claimed victims against 2,252 in the second quarter, a 30 percent rise; Halcyon logged 2,766, up 39.1 percent, across 111 groups in 122 countries; Comparitech counted 2,627, up 29 percent per its own roundup. Three trackers, three double-digit increases, one shared method: they count announcements on leak sites.

ReliaQuest then wrote the sentence that ought to travel with every one of those figures — the increase "is unlikely to reflect a real increase in ransomware activity," its own threat spotlight says. Forty-three first-time groups accounted for 93 percent of the growth while crews that operated in both quarters added barely a percent, and several of the new names carry the fingerprints of rebranding or recycled victim data. Because the second quarter was itself down 15 percent, the third sits only about 10 percent above where the year began. And Comparitech found that 247 of its 2,627 claimed victims — 9.4 percent — confirmed the attack themselves.

So the volume story is unmeasured, and that matters for my argument rather than against it — our brief this afternoon worked through the same arithmetic. When nine in ten counted attacks cannot be confirmed by the victim, the leak-site count is not a threat metric. It is a marketing metric, and it is the one the industry quotes because it is the only one that goes up reliably.

The capability moved, just not where anyone looked

Recorded Future's Allan Liska gave the honest version of the technical picture to Wired: language models show up in better phishing lures and in the negotiation calls, but the successful groups are still largely human-operated, and the number of attacks involving actual encryption may fall as crews shift to pure data extortion. Halcyon's Cynthia Kaiser put the geographic split the same careful way — the United States comparatively steady, international attacks up sharply, the rise "in part fueled by AI."

Both statements are consistent with the 12-out-of-405 number. What AI has not done is produce malware that beats an endpoint agent. What it has done is make the front of the attack cheap: a good lure, a plausible voice on the phone, and a credential that already works.

Then look at what scaling actually looked like. Token theft is the ideal job for an agent, because it needs no exploit, no zero-day and no user to click at the right moment — it needs a session, and sessions are now the currency of everything we are building. The agentic stack we are all shipping this quarter is a stack of delegated credentials: OAuth grants, refresh tokens, service accounts, API keys with no owner. An attacker who harvests those does not breach forty tenants. He logs into them, in parallel, with the front door key and a valid badge. The identity problem we wrote about in MCP's hardest problem: proving which agent asked for what is the same problem from the other side of the table.

The economics follow. Malware is an asset that depreciates — signatures catch up, and Halcyon's 12-for-12 record is what depreciation looks like. A token is an asset that appreciates for as long as nobody revokes it, and most organisations cannot say how long that is. That is why 43 new names can appear in a quarter without any of them inventing anything: the entry cost is a phishing kit and patience.

The counter-case, fairly stated

Stolen credentials were the most common way into a network a decade before anyone said agentic, so the AI framing may be decoration on an old problem. Halcyon is describing its own research, with an interest in emphasising the novel, and "AI agents" is its characterisation of a campaign the rest of us cannot inspect. A 12-for-12 detection record is not a weakness in the industry's story; it is the industry's story, and it argues for buying more of what already works. And the damage at the end of these incidents is still encryption and extortion. Nobody has ever lost a quarter's revenue to a stolen refresh token.

The sharpest version of the objection is the one ReliaQuest hands over: if most of the new crews are rebrands, there is no cheaper market and no long tail — it is the same gangs wearing new names, and my cost-curve story is a rumour with a logo.

Why the take still holds

Because the counter-case is about means and ends, and my claim is about which one you can afford to defend. Grant that extortion is the end. The means is a login, and a login that gets revoked before it is used cannot encrypt anything. You do not need to know which brand of criminal is holding the token to take it away from him; you need to know the token exists.

The rebrand objection also explains less than it appears to. Rebranding is what a market does when entry is cheap and reputations are disposable — the point is not that 43 genuinely new organisations appeared, it is that a name is now worth less than the tooling, which is the signature of a commoditised crime market rather than a professional one. And the fragmentation has a cost the count misses: a counterparty with no reputation has no reason to delete your data after you pay, which is precisely the assurance the insurance market is built on. Extortion without a reputational hostage is worse than extortion with one, and it is cheaper to run.

The 40 tenants in 34 hours is the part that no rebrand story covers. That is not a renamed gang working faster. That is automation against an identity layer that was never designed for software to hold the keys.

What would change my mind

Independent telemetry — not a vendor's — showing AI-linked samples reaching protected endpoints at material rates, with encryption behind them. Or a quarter where victim-confirmed incidents climb while new-group counts stay flat, which would mean real capability rather than a claims boom. Or Halcyon's token campaign retracted, traced to an ordinary infostealer with no agentic component.

The one that would settle it fastest is duller: a published median time-to-revoke for compromised tokens, per sector, the way we now publish mean time to detect. If that number is already under an hour, the exposure I am describing is priced, and the marginal dollar belongs at the endpoint after all. I doubt it is. Most organisations I have spoken to cannot answer the question at all, which is my point — you cannot price a risk you do not measure, and this quarter the industry measured the one layer where AI is losing.

If a stolen token needs no exploit and no malware, why is the entire ransomware budget still aimed at the payload? Write to us via our contact page.