DEV Community: IntelligenceX

Dashlane Confirms Brute-Force Attack Led to Download of Encrypted User Vaults

IntelligenceX — Thu, 04 Jun 2026 07:08:54 +0000

Password manager Dashlane said that a recent brute-force attempt let threat actors download encrypted password vaults for a small group of users- kind of a weird situation. The company mentioned that fewer than 20 personal subscription accounts were impacted during the incident- not many people overall.

This happened in late May 2026, and from what’s been described, it targeted Dashlane accounts through lots of repeated sign-in tries. Researchers also suggest the attackers were trying to get around two-factor authentication, and at the same time register devices they should not have been able to use, on already existing user profiles.

Dashlane said its security systems noticed extremely high volumes of login activity, and then kicked in protections automatically. Those included short-term account suspensions, plus authentication restrictions, which is honestly the sort of thing you want. The company claims these safeguards reduced the damage a lot, and stopped the attack from turning into something broader, like full account takeover for more users.

Even if the attackers managed to be successful in a limited number of situations, the downloaded vaults stayed encrypted. Dashlane said that getting to what’s inside a vault still relies on the user’s Master Password, and that credential is never stored by the company.

Security experts generally point out that encrypted password vaults are hard to break into, as long as people pick strong, unique Master Passwords. That said, weak, predictable, or recycled passwords could raise the odds for offline password cracking, especially when vault data is taken.

The company also clarified that there was no breach of its internal infrastructure, and that what happened was only tied to targeted user accounts rather than something like a compromise of Dashlane’s systems.

As a precaution, users are encouraged to look over every device connected to their account, remove anything that feels unfamiliar, make sure two-factor authentication is turned on, and use long, unique Master Passwords that are more resistant to brute-force type guessing attacks.

The incident is also another kinda reminder that even when security tools offer strong encryption, the real safety of an account still relies a lot on solid authentication habits, plus good password hygiene, and not just the crypto side.

Cybersecurity-centered organizations like IntelligenceX keep emphasizing the importance of strong password management, multi-factor verification, credential monitoring, and proactive account protection, because attackers are increasingly going after identity and sign-in systems.

Miasma Supply Chain Attack Targets Red Hat npm Packages with Credential-Stealing Malware

IntelligenceX — Thu, 04 Jun 2026 05:51:11 +0000

Cybersecurity researchers have uncovered a new software supply chain attack campaign, dubbed Miasma, that compromised multiple npm packages associated with Red Hat cloud services. The campaign is designed to steal developer credentials, cloud secrets, CI/CD tokens, and other sensitive information while also attempting to spread itself further through software development environments.

Researchers say the attack shares several characteristics with previous "Mini Shai-Hulud" malware campaigns, including install-time execution, credential harvesting, encrypted data exfiltration, and mechanisms designed to compromise additional systems within the software supply chain.

Several affected packages were reportedly linked to Red Hat cloud service projects and were used by developers in enterprise environments. Once installed, the malicious packages executed hidden code before installation was completed, allowing attackers to quietly collect sensitive information from infected systems.

The malware targeted a wide range of credentials and secrets, including GitHub tokens, npm authentication tokens, cloud provider credentials, Kubernetes secrets, SSH keys, Git configuration data, and other files commonly used in software development workflows.

Researchers also found that the malware attempted to compromise CI/CD pipelines by modifying GitHub repositories and injecting malicious workflows. In some cases, the malware reportedly abused GitHub APIs to make changes that appeared as legitimate signed commits, making malicious activity harder to detect.

Another notable feature of the campaign was its focus on cloud environments. Unlike earlier variants that primarily collected secrets, this version expanded its capabilities to gather information about cloud identities and accessible resources in major cloud platforms. Researchers believe this indicates a growing attacker interest in gaining direct access to cloud infrastructure rather than simply stealing credentials.

The malware also included persistence mechanisms designed to automatically reactivate itself within developer environments. Investigators observed attempts to modify configuration files associated with development tools and code editors to ensure the malicious code would continue running during future sessions.

Security researchers suspect the campaign may have originated from a compromised developer account, allowing attackers to inject malicious code into legitimate software packages without immediately raising suspicion.

Organizations that installed affected packages are advised to remove compromised versions, rotate all potentially exposed credentials, review cloud access permissions, inspect CI/CD environments for unauthorized changes, and monitor repositories for suspicious activity.

The incident highlights the growing sophistication of software supply chain attacks, where trusted development tools and open-source ecosystems are increasingly being targeted to gain access to enterprise environments.

Cybersecurity-focused organizations like IntelligenceX continue to emphasize dependency security, credential protection, software supply chain monitoring, and proactive threat intelligence as attacks against developer ecosystems continue to evolve and expand.

China-Linked Cyber Espionage Campaign Targets Taiwan and Czech Republic

IntelligenceX — Thu, 04 Jun 2026 05:11:23 +0000

Cybersecurity researchers say they found a fresh cyber espionage setup; it’s called Operation Dragon Weave, and it seems to be going after a mix of places like government agencies, research institutions, tech orgs, financial entities, and even academic groups both in Taiwan and the Czech Republic. From what they can tell, the activity is likely tied to China-aligned threat actors, and it’s mainly about intelligence gathering plus staying inside victim networks for a long time, quietly, almost like it is just waiting.

The researchers report the whole thing starts with spear-phishing emails that are pretty carefully made, and the messages include ZIP attachments. Once the ZIP is opened, it kicks off a multi-step infection chain meant to install malicious code under the radar while also looking plausibly normal to the person receiving it.

One of the ways they described uses a malicious Windows shortcut file that’s dressed up as a PDF. So when it’s opened, it runs hidden scripts that pull out additional malware pieces, and then they get launched. A second path is simpler in a sense, because victims may just end up running a malicious file that sits inside the archive directly. In the end, both routes funnel into the same outcome, which is the deployment of a pretty advanced malware framework built for remote control and stealing data.

For the last stage, the team says the final payload is an AdaptixC2-based implant. This implant helps attackers take over compromised systems, gather sensitive information, and keep persistence inside the targeted environments. They also mention that the malware uses cloud-based infrastructure to talk to its command and control servers, so defenders have a harder time spotting what’s going on.

The campaign also folds in advanced evasion techniques, including anti-analysis checks that try to figure out whether the malware is running inside a sandbox or some security testing environment. If analysis is spotted, the malware can tweak its conduct to reduce exposure.

The discovery arrives while broader chatter suggests China-linked threat groups stayed pretty active through late 2025, early 2026. Researchers say they have seen several campaigns aimed at government entities, critical infrastructure, defense organizations, and also technology companies across Europe, Asia, and South America.

Security experts point out that today’s cyber espionage efforts increasingly lean on real cloud services, DLL side-loading methods, and custom-built malware loaders. The whole thing is meant to slip past older security barriers, so attribution and even detection gets much harder for defenders.

Organizations are told to improve email security, watch for odd file execution behavior, roll out endpoint detection tools, and keep running phishing awareness training for staff. Early detection still matters a lot since espionage-oriented intrusions can otherwise gain a foothold inside corporate networks, and government environments too.

Cybersecurity-focused groups like IntelligenceX keep stressing threat intelligence, proactive monitoring, and stronger detection features, especially as state-sponsored cyber operations keep becoming more discreet, more complex, and harder to catch.

Why MSPs Are Moving Beyond Traditional vCISO Platforms

IntelligenceX — Wed, 03 Jun 2026 12:34:01 +0000

MSPs and MSSPs are, lately, rethinking the way they deliver their cybersecurity services. At first, platforms built around a virtual Chief Information Security Officer (vCISO) were the main go-to, mostly for security assessments, ongoing reporting, and that sort of advisory work. But as things get more tangled the whole cybersecurity program getting more complex-really, there’s more need for a wider, kind of “bigger umbrella” model called a Security Growth Platform.

This change is being pulled forward especially by the rapid expansion of the small and medium-sized business (SMB) cybersecurity market. A lot of SMBs don’t have a dedicated security leader, so they end up leaning on MSPs to basically be their security team. Because of that, providers are now expected to keep security programs moving, handle compliance obligations, run risk assessments, produce reporting, and support strategic planning across dozens or, in some cases, even hundreds of customers at the same time.

Traditional vCISO tools kind of leaned toward individual consulting moments. In practice, they’re mostly built around assessments, report writing, and that advisory flow stuff. It works fine when it’s just one client at a time, but when you need large-scale security work across many customers, they start getting awkward. In the same vein, most enterprise-style governance, risk, and compliance (GRC) platforms are usually aimed at organizations that run their own security program, not at service providers delivering the program for multiple clients, day after day.

Researchers point out there’s a newer type of platform showing up to fill this gap. The idea is that it pulls together security program management, compliance mapping, risk assessment, automation, portfolio visibility, and business intelligence into one place, and it’s made for MSP environments specifically. Not a tweak, more like a purpose-built setup.

One big differentiator is that it lets you manage security across the whole client portfolio, rather than being stuck on one engagement at a time. Things like multi-tenant management, framework alignment, automated reporting, risk prioritization, and revenue visibility give service providers room to scale, while still keeping things consistent from client to client.

The evolution kind of shows a bigger industry movement, where cybersecurity services shift into something more operational and continuous, rather than being all, like, one-off projects. MSPs are also getting pushed to deliver ongoing security direction, compliance support, risk stewardship, and strategic counsel as a normal part of longer-term service packages.

And as the cybersecurity pressure keeps rising, service providers seem to be actively searching for platforms that don’t just back up the actual security work, but also help with the day-to-day operations and the business side too, especially when managing large-scale security programs.

Organizations that are centered on cybersecurity, like IntelligenceX, keep putting emphasis on scalable security administration, clearer risk visibility, compliance readiness, and proactive security operations because companies are depending more and more on service providers to improve their overall cybersecurity posture.

GREYVIBE Uses AI-Assisted Malware in Ongoing Cyberattacks Against Ukraine

IntelligenceX — Fri, 29 May 2026 11:45:54 +0000

Cybersecurity researchers say they’ve found what looks like a brand new, not-yet documented threat group, GREYVIBE, and it’s been doing cyber espionage stuff aimed at Ukraine and Ukraine-related organizations since 2025 at least. The group is thought to be Russian-speaking, and if you look at how they operate, a lot of their moves match up pretty closely with Russian strategic interests, especially in the situation around the ongoing conflict tied to Ukraine.

According to researchers, GREYVIBE has apparently targeted military, government, civilian, and business organizations, using different kinds of attack approaches. They reportedly include spear phishing emails, false CAPTCHA confirmation pages, counterfeit web pages, and trick downloads of files meant to drag victims into getting custom malware installed on their systems.

One of the most notable parts of the campaign is the group’s apparent use of artificial intelligence. Researchers found signs that GREYVIBE was leaning on AI tools, along with large language models, to aid in the making of malware components. It also seemed to be used for generating phishing material, developing scripting pieces, and giving extra support to other sections of its overall attack infrastructure, kind of like a supporting cast that helps everything run smoother.

The threat actor has deployed various malware families, including remote access trojans that can gather system information, carry out commands, pilfer files, take screenshots, and pull browser data. Also, certain variants were tuned to collect messaging app data and to keep long-term access on the compromised systems.

Researchers noticed a few different assault campaigns, kinda like they were passing around fake Zoom pages, malicious meeting invitations, tricky charity websites, and even bogus adult-style sites made to lure people into pulling down malware. In certain cases, the intruders also tacked on real-time audio and video bits so the whole thing would feel more believable, more convincing, really.

Even with signs of innovation from AI-assisted development, researchers say GREYVIBE has still made a number of operational mistakes, which implies the group might not have the same sort of sophistication that is usually linked to top-tier nation-state actors. There is also evidence suggesting possible links to cybercriminal communities, so the boundary between state-related activity and profit-driven cybercrime starts to get a bit blurry, almost like it’s interleaved rather than cleanly separated.

The campaign kinda shows how threat actors are getting better at using AI technologies to speed up malware creation, and also grow their day-to-day operational reach. As AI tools become more widely reachable, security researchers think that we’ll see kind of the same tactics show up more often across the cyber threat scene.

Cybersecurity-focused organizations like IntelligenceX keep stressing how threat intelligence matters, phishing awareness, endpoint monitoring, and really proactive security steps, because AI-assisted cyber threats are still evolving.

Shadow AI Is Evolving Into a Much Bigger Security Problem

IntelligenceX — Fri, 29 May 2026 10:52:14 +0000

For years, “Shadow AI” basically meant employees using AI chatbots on the side, quietly, without approval from security teams. But now cybersecurity researchers are saying there’s a bigger thing going on: people are building, and then deploying full AI-generated applications, without bringing in IT or security at all.

This is getting easier thanks to “vibe coding” platforms. They let non-developers create real, working applications just by describing what they want in normal, plain language. After that, the apps can be wired into business systems like CRMs, ticketing platforms, analytics tools, financial software, and even internal databases. And in a lot of cases, they get published straight to the internet with almost no security review, or sometimes none.

Researchers recently looked at thousands of publicly accessible applications that were made using AI-driven development platforms, and they found that many were exposing sensitive business, operational, or personal data. In some reports, the applications didn’t even have basic authentication in place. So basically, the information was reachable by anyone who managed to find the URL.

One reason these risks get missed is that most traditional security tools were never really built for this exact situation. Endpoint security might only catch what happens in the browser, but not what the application is doing or producing inside the browser. Data loss prevention can watch known pathways, yet it often overlooks data flowing directly between cloud applications. Also, many governance tools have trouble telling custom-made AI applications apart from normal cloud platforms, so the signals get muddled.

Security experts say organizations should start by figuring out which AI-made applications employees have been building, then check what kinds of systems those tools connect to, and finally decide if anything is reachable from the public. From there, setting up a straightforward approval process and keeping ongoing visibility into AI-related development activity is now turning into a must-have in many current cybersecurity programs, not just a “nice to have.”

And as AI-powered development tools keep getting more popular, companies run into a tougher balancing act: pushing innovation and day-to-day productivity while also keeping security and governance tight. It can start as a simple internal utility, then somehow, in short order, become an internet-facing application that holds sensitive business data, especially if the right guardrails were never put in place.

Organizations with a cybersecurity focus, like IntelligenceX, keep stressing visibility, careful AI onboarding, and proactive governance because AI-generated applications are showing up everywhere across modern enterprises.

North Korean Hackers Expand Malware Arsenal in New Campaigns Targeting South Korea

IntelligenceX — Fri, 29 May 2026 06:45:29 +0000

The North Korean state-sponsored threat group called Kimsuky has been tied to several cyber espionage campaigns aimed at military organizations, government agencies, and also private companies in South Korea during the early part of 2026.

Researchers report that the attackers leaned hard on social engineering tricks, like bogus software installation pages or counterfeit online meeting portals, to get people to download malware. In a number of incidents, the malicious sites were designed to look like real South Korean security software providers and also common business communication platforms, which makes it harder for users to notice.

In one campaign, fake installers showed up as popular security tools. After someone downloaded them, the files quietly spread malware components that created persistence on the system, and then reached out to attacker-controlled servers to retrieve extra payloads. Analysts think the group only sent the malware to specific victims after first confirming their targets.

Another campaign apparently abused fake meeting invitations, which mimicked legitimate Webex sessions. Victims were prompted to grab a “camera-fix” utility before joining. However, that download ended up installing multiple malware stages, and in the end, it deployed HTTPSpy, a strong remote access trojan.

HTTPSpy gives attackers broad operational control of compromised machines. It can send commands, move files up and down, grab screenshots, start or manage processes, and even try to erase signs that anything bad happened. Researchers also said that Kimsuky has been using variants of this trojan for years already, and still works on making its features more capable and harder to detect.

Security researchers noticed that the group is adopting newer kinds of techniques and tool sets, like Visual Studio Code Remote Tunneling, Cloudflare Quick Tunnels, remote management software, and even malware built with Rust. They also tied new malware lineages to the same cluster, including HelloDoor and HttpMalice, both meant to enable quiet access, plus data harvesting capabilities, in a stealthy kinda way.

One other clear change is that the attention on data theft is getting stronger. In recent variants, they observed the collection of sensitive documents, screenshots, keystrokes, USB device details, and digital certificates from machines that were already compromised. Researchers think this behavior is aimed at longer-term espionage goals, not just quick money or immediate profit, so the incentives look more strategic than transactional.

This campaign really shows how advanced adversaries keep evolving, mixing legitimate software, trusted cloud services, and careful social engineering methods, to dodge detection and also keep persistent access inside target environments.

Cybersecurity-focused organizations, such as IntelligenceX, keep stressing how crucial it is for users to have awareness, to use secure authentication practices, to monitor endpoints, and to rely on proactive threat intelligence, especially as state-backed cyber threats keep becoming more intricate, harder to spot, and kinda more slippery over time.

Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code

IntelligenceX — Fri, 29 May 2026 06:34:05 +0000

A critical security flaw was found in Gogs, a well-known open-source, self-hosted Git service, and it might let authenticated users run arbitrary code on vulnerable servers that are vulnerable, yeah, basically.

The problem was given a CVSS score of 9.4, which puts it among the most severe reports for Gogs. Researchers say the weak spot can be used via Git’s “Rebase before merging” option, so attackers can slip in harmful commands while pull request work is happening, during those merge-related steps.

From what they describe, the attacker only needs to have a real, valid user account. And in default Gogs configurations, regular users can make their own repositories, switch on rebase merging, and then actually exploit the bug, all of that without administrator privileges, and also without needing any special clicks or cooperation from other people.

The root cause seems to be how Git treats the --exec option when rebase operations occur. If an attacker crafts a malicious branch name, they can end up injecting commands that then get executed on the underlying server, once the rebase process starts running. In practice, this turns into remote code execution on the host.

Researchers also caution that if someone exploits it successfully, the fallout could be pretty nasty. For example, attackers might access hosted repositories, pull out sensitive credentials, pivot across internal networks, and possibly take over other systems that are connected to that same server, later on.

This is especially worrying for orgs running shared Gogs instances with multiple people using the platform at the same time. With a successful attempt, private repositories belonging to other users can become exposed, and that becomes a real cross-tenant security problem.

When disclosure happened, the issue reportedly stayed unpatched, so administrators were left relying on short-term mitigation steps, kind of like band-aid solutions. Security experts say to disable public user registration, tighten who can create repositories, and go back through the repositories where rebase merging is switched on, to double-check what’s exposed.

Researchers also estimate that over a thousand internet-facing Gogs instances might already be reachable from the outside, yet the actual count is probably far above that once private setups and internal deployments get included too.

This incident is just another signal that development platforms and source code management systems keep looking like easy targets for criminals, largely because the sensitive data and access privileges they hold can be very valuable.

Organizations with a cybersecurity focus, like IntelligenceX , keep stressing secure software development habits, better access control management, and ongoing vulnerability monitoring, as key protections against attacks aimed at development infrastructure.

Attackers Exploit FortiClient EMS Vulnerability to Deploy Credential-Stealing Malware

IntelligenceX — Fri, 29 May 2026 06:20:26 +0000

Cybersecurity researchers have come across this campaign where threat actors use a really critical FortiClient Endpoint Management Server (EMS) vulnerability, kinda to push credential-stealing malware onto endpoints that are already managed.

They say the whole thing hinges on CVE-2026-35616, which is high-severity and lets an attacker bypass API authentication, then end up with elevated privileges inside FortiClient EMS environments that were not properly updated. Fortinet already put out patches for it, but researchers reported seeing real-time exploitation in the wild against systems that stayed unpatched.

From what they observed, the attackers basically used the compromised EMS infrastructure itself to issue malicious commands to the endpoint devices. Since they’re abusing the trusted management pathways, the behavior looks pretty much like normal admin work, so defenders might miss it, or at least have a harder time proving what’s going on.

Once access was achieved, the attackers reportedly changed endpoint policies and management settings so malicious PowerShell scripts would run across connected devices. And because EMS is central, managing tons of machines at once, one EMS compromise could turn into a blast radius over an entire organization.

The chain they described involved a legitimate FortiClient component that starts scripts that then pull down a malicious executable, but it’s masked like a software update. This fake file is called "FortiEndpoint_Patch.exe", and it’s not a real patch at all, but rather a kind of information-grabbing malware meant to collect sensitive browser data.

Investigators found that the malware can steal passwords, cookies, saved login sessions, autofill entries, addresses, phone numbers, and even stored payment card information from Chromium-based and Gecko-based browsers. After that, the gathered data was packaged up for sending back to the attacker-controlled infrastructure.

One of the most concerning parts of the campaign is the possibility of session hijacking, like someone else just picking up where you left off. With stolen browser cookies and already authenticated sessions, an attacker could get into cloud services, business applications, and internal systems. And they may not even have to keep repeatedly dodging multi-factor authentication, which is, frankly, the point that makes this so worrying.

This incident shows how threat actors are leaning more and more toward management platforms and other trusted enterprise tools, because it lets them maximize impact. Rather than compromising devices one by one, attackers can abuse centralized infrastructure, then push malware everywhere in a kind of coordinated, quick way.

If you’re using FortiClient EMS, you’re strongly advised to apply the latest security updates. Also, take a moment to review endpoint management policies, monitor PowerShell activity, and look into any strange configuration changes. In addition, security teams should think about rotating credentials and invalidating active sessions if compromise is even suspected, even slightly.

Cybersecurity-minded organizations, like IntelligenceX, keep stressing patch management, privileged access security, and continuous monitoring. They point out that attackers are increasingly abusing trusted enterprise management systems to distribute malware and pilfer credentials, not just to cause random disruption.

Microsoft Criticizes Public Zero-Day Disclosures After Researcher Account Takedowns

IntelligenceX — Fri, 29 May 2026 06:09:51 +0000

Microsoft has again, pretty clearly reaffirmed its backing for Coordinated Vulnerability Disclosure (CVD), saying that security researchers should kind of share the vulnerability details with vendors first, privately, before they go public. This comment arrived after a run of high-profile zero-day reports, hitting several Windows pieces, were shared without any real prior coordination.

Over the last few weeks, a security researcher going by “Chaotic Eclipse” reportedly revealed a handful of previously unknown vulnerabilities tied to Microsoft products, including Windows Defender and BitLocker. Microsoft says those issues showed up publicly before the company had had enough time to dig in, gauge the real-world impact, and then craft security updates.

Microsoft also warned that uncoordinated disclosures can put customers in needless danger. This gets especially serious, the company argues, when proof-of-concept exploit code ends up public before patches are actually ready. They added that multiple of the vulnerabilities mentioned have already shown up in the wild, meaning they have been seen during active exploitation.

The discussion covered several flaws that were given nicknames like BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma. Security experts point out that when public exploit releases appear quickly, it often reduces the effort and know-how required for cybercriminals to start weaponizing newly discovered weak spots.

The whole thing got more heated after GitHub was reported to have removed the researcher’s account, an account that hosted proof-of-concept material related to the vulnerabilities. Additional reports say that content with a similar nature, uploaded elsewhere, was later taken down too, which further widened the gap between the researcher and Microsoft.

The researcher has publicly criticized Microsoft’s approach to the disclosure process, saying earlier communication tries didn’t land properly, and showing real irritation about the account removals. This whole thing has also managed to re-spark the conversation inside the cybersecurity community about how responsible disclosure should work, whether researchers get recognized, how responsive a vendor really is, and how much public transparency is too much or not enough.

Plenty of security people back coordinated disclosure, as it can protect users in a structured way, but others will argue that public disclosure can also act like a nudge, pushing vendors to answer sooner for unresolved security issues. Still, that delicate mix between openness and keeping users safe is basically one of the most discussed points in all of cybersecurity.

Since zero-day vulnerabilities keep showing up as a key part in cyberattacks, organizations are encouraged to put patch management first, keep vulnerability monitoring running consistently, and maintain threat intelligence programs, so they reduce exposure to those newer and nastier risks that keep emerging.

Cybersecurity-focused groups like IntelligenceX keep stressing responsible vulnerability management, timely security updates, and early risk assessment as crucial pieces in modern cyber defense, no question.

Enterprise AI Risk Is Being Driven by a Small Group of Power Users

IntelligenceX — Fri, 29 May 2026 05:46:38 +0000

A new AI usage study has revealed that enterprise AI risk is far more concentrated than many organizations realize. Rather than being evenly distributed across all employees, most AI-related exposure comes from a small group of highly active users who engage with AI tools far more frequently than the average employee.

Researchers found that while AI adoption continues to grow across workplaces, most employees remain casual users. However, a small percentage of users generate significantly more conversations, use multiple AI platforms simultaneously, and engage in deeper interactions, thereby increasing the likelihood of sensitive data exposure.

The report also highlights the rapid growth of “Shadow AI” - AI tools operating outside traditional governance and security controls. Employees are increasingly using browser extensions, AI assistants, coding copilots, AI search engines, and personal AI accounts that organizations often cannot fully monitor or manage.

Another key concern is the widespread use of personal AI accounts for work-related tasks. Researchers found that a significant portion of enterprise AI activity occurs through personal identities rather than company-managed accounts. This creates governance challenges because organizations lose visibility into how prompts, files, and sensitive information are handled once they enter external AI ecosystems.

The study also found that sensitive information is already being shared with AI platforms regularly. Personal data, financial information, and internal IT-related content were among the most commonly exposed categories. Consumer-focused AI platforms generally showed higher rates of sensitive data exposure than enterprise-managed alternatives.

Researchers further warned about the growing use of AI browser extensions and AI connectors that integrate directly with services such as GitHub, SharePoint, Slack, Atlassian, and Google Workspace. These integrations can significantly expand an organization’s attack surface if not properly governed.

Security experts recommend focusing on visibility, governance, identity management, and real-time monitoring rather than simply blocking AI tools. As AI adoption continues to accelerate, organizations need stronger controls to balance productivity with security.

Cybersecurity-focused organizations like IntelligenceX continue to emphasize the importance of secure AI adoption, data governance, and visibility into AI-driven workflows as enterprises increasingly integrate artificial intelligence into daily operations.

Enterprise AI Risk Is Increasing Through Shadow AI and Power Users

IntelligenceX — Thu, 28 May 2026 12:30:48 +0000

A new enterprise AI usage report kind of revealed that security risks connected with AI inside organizations are being pushed a lot by a small group of “AI power users” and by AI tools that are basically left unmanaged, operating outside whatever normal governance controls there used to be.

Researchers reported that even if AI adoption is growing really fast across workplaces, only a comparatively small percentage of employees actually use AI tools in an intensive way. Still, these users create a disproportionate amount of AI activity, often tapping into several different platforms at once and holding longer and more complicated conversations, where sensitive company data is involved.

The same report also points out that enterprise AI usage is getting more fragmented over time. Employees are not sticking to just one AI assistant anymore; instead, they bounce between multiple browser extensions, coding copilots, AI search engines, embedded assistants, and external AI platforms, all during the same day-to-day workflow. It feels like everything is happening in parallel.

One big worry is the very common practice of personal AI accounts being used inside corporate environments. Researchers noticed that a sizable portion of enterprise AI conversations go through personal identities, not through corporate-managed accounts. That leads to governance blind spots, because organizations lose the ability to see clearly how company data is stored, processed, or even potentially used for model training.

Finally, the report says sensitive information is already being shared regularly with AI systems. Personal data, financial information, and internal IT-related details showed up in enterprise AI interactions. Consumer-facing AI platforms turned out to have much higher exposure rates when compared to enterprise-managed AI environments.

Researchers also warned about the growing risk posed by AI browser extensions and AI connectors, which, yes, sounds kind of obvious, but it's still escalating. A lot of extensions ask for high-level browser permissions, while the connectors now tend to hand AI systems straight through direct access to enterprise tools like GitHub, SharePoint, Slack, and Google Workspace.

Security experts think the classic “block or allow” setup just is not cutting it anymore for AI governance. What they are pushing instead is more real-time monitoring, inline guardrails, and clearly approved AI usage policies. Plus, organizations need stronger visibility into AI-related activity across their enterprise environments, not just at the perimeter.

Cybersecurity-focused organizations like IntelligenceX keep stressing AI governance, identity management, and secure AI adoption. Especially because businesses are integrating AI tools into everyday operations faster than anyone can really audit.