INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Australian AI-Driven Cyber Scams Increase by 66% in Recent Months

| 2026-10-28 07:25 CRITICAL LOW AI-ENABLED ATTACK · AUTONOMOUS DATA BREACH PHISHING & SOCIAL ENGINEERING
JSON
Executive Summary
AI-generated
In April 2026, ASD's ACSC and international partners highlighted a shift by China-nexus actors. The Australian Data Breach Incidents Up 66% as AI Sharpens Scams report found that attackers are using AI to write phishing emails with no spelling or grammar errors and to automate targeted spearphishing tactics, resulting in extensive compromises rising from 26 to 40. Cyber operations of this nature were most visible in social engineering, with the number of ransomware incidents holding steady at 139 but extensive ransomware incidents increasing from 16 to 24. The report also noted that data breaches made up 98 incidents, a 66% increase on the previous year, and notified Australian entities of potentially malicious activity more than 4,400 times, almost 80% more than in FY2024-25.
Technical Mitigations AI-generated
• Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation. • Audit (ATT&CK mitigation for Social Engineering): Enables correlation of email/identity/SaaS/endpoint activity that appears legitimate. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FIVE_EYES FIVE_EYES healthhealth manufacturingmanufacturing
Incident Timeline
‎April 2026
China-nexus actors shifted their tactics, highlighting a 66% increase in Australian data breach incidents involving phishing and targeting critical infrastructure divisions like Financial and Insurance Services.
source_region China
In April 2026, ASD’s ACSC and international partners highlighted a shift by China-nexus actors.
organisation Financial and Insurance Services
Phishing was the leading initial access technique at 36%, and Financial and Insurance Services was the most affected critical infrastructure division at 30%.
‎May 2026
State-sponsored actors targeted Australian government, business and individuals to gain sensitive information via compromised accounts and credentials.
organisation cPanel
A single notification about cPanel vulnerabilities, sent to 340 entities in May 2026, led to more than 60 confirmed incidents.
general_metric 340 entities
A single notification about cPanel vulnerabilities, sent to 340 entities in May 2026, led to more than 60 confirmed incidents.
general_metric 60 confirmed incidents
A single notification about cPanel vulnerabilities, sent to 340 entities in May 2026, led to more than 60 confirmed incidents.
organisation Data
Data breaches made up 98 incidents, a 66% increase on the previous year.
organisation the Office of the Australian Information
Separately, the Office of the Australian Information Commissioner received 1,205 breach notifications in 2025.
organisation State Actors and Critical Infrastructure
State Actors and Critical Infrastructure in the ASD Cyber Threat Report State-sponsored actors continued to target Australian government, business and individuals to gain sensitive information.
‎2025-26
Australian data breach incidents increased by 66% in the 2025-26 period, according to the ASD Cyber Threat Report.
‎2026/10/28
Attackers are using AI to write and automate targeted phishing emails with no spelling or grammar errors.
organisation Australian Data Breach Incidents
Australian Data Breach Incidents Up 66% as AI Sharpens Scams.
organisation AI Sharpens Scams
Australian Data Breach Incidents Up 66% as AI Sharpens Scams.
organisation the Australian Signals Directorate’s
It is the seventh annual assessment from the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).
organisation ReportCyber
In FY2025-26, the agency received more than 82,000 cybercrime reports through ReportCyber.
organisation ASD
ASD’s ACSC makes one clear distinction.
organisation Incident Severity Grows
Incident Severity Grows in ASD Cyber Threat Report Data Only one Category 2 incident was recorded this year.
‎October 2026
The Australian Cyber Security Centre (ACSC) released the Essentials series, evolving its Essential Eight into a principles-based framework with three chapters.
organisation Suspicious
Suspicious activity, incidents and vulnerabilities can be reported at cyber.gov.au or through the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
organisation cyber.gov.au
Suspicious activity, incidents and vulnerabilities can be reported at cyber.gov.au or through the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
organisation CYBER1
Suspicious activity, incidents and vulnerabilities can be reported at cyber.gov.au or through the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
organisation Operational Technology
It evolves the Essential Eight into a principles-based framework with three chapters: Enterprise IT, Operational Technology and Cloud.
Intelligence Sources
The Cyber Express 2026-10-28