Microsoft: AI Cyberattacks Now Hit in Minutes, India a Top Target

Microsoft put a number on something security teams have been feeling for a while: the gap between when a hacker finds a weakness and when they actually use it has shrunk to under 24 hours. That's the headline from the company's 2026 Digital Defense Report, released on October 1 and built from a year of data collected across Microsoft's own products, its incident-response teams, and threat intelligence pulled from trillions of signals a day.

Attackers found a shortcut, and it's AI

The report tracks intrusions Microsoft's responders investigated between July 2025 and June 2026, and the shift in how attackers get in the door is stark. Phishing — tricking someone into clicking a bad link or handing over a password — was the entry point in 23% of cases, up from just 7% a year earlier. Attacks on public-facing applications, the websites and login portals companies expose to the internet, rose from 15% to 24% over the same stretch.

The common thread is AI doing the grunt work that used to limit how much damage one hacker or crew could do. Drafting a convincing phishing email in a target's own language, mimicking a company's writing style, building a fake login page that looks pixel-perfect — all of that used to take skill and time. Now it's largely automated.

"AI fixes all four simultaneously," the report notes, referring to the traditional giveaways that once exposed a scam — forged documents, awkward writing, accents, and a thin or fake online presence.

Microsoft also flagged a newer wrinkle: adversary-in-the-middle kits, which sit invisibly between a victim and the real login page to steal session tokens and slip past multi-factor authentication, now account for 44.6% of phishing techniques the company identified — ahead of plain old fake-link phishing at 33.6%.

Why this matters beyond Microsoft's own customers

None of this is abstract for Indian organisations. The report places India among the top three countries globally targeted by nation-state-linked hacking groups, and it's responsible for roughly 13% of all cyberattacks tracked across the Asia-Pacific region — a notable share for a country that, until recently, wasn't seen as a primary target compared to the US, Japan, or Australia.

For Indian banks, fintech platforms, and the IT services firms that run back-office operations for clients worldwide, faster weaponisation means less time between a patch being skipped and an actual breach. CERT-In's existing six-hour incident reporting window already assumes attacks move fast; this report suggests the window for detection before damage is done is shrinking even further. It also raises the stakes for how seriously companies here treat routine patching and MFA rollout, since the report's own figures show standard multi-factor authentication isn't the safety net it once was against AI-assisted phishing kits.

Defenders are reaching for the same tools

The flip side Microsoft wants to emphasise is that defenders aren't standing still either — the company is building AI-driven detection directly into its security products to catch this faster-moving activity in real time, rather than relying purely on after-the-fact forensics. It's part of a broader industry shift: security vendors have been pouring money into agentic AI tools that can watch, flag, and in some cases respond to suspicious activity without waiting on a human analyst, a trend Code24 covered recently with Palo Alto Networks' $500 million bet on agentic AI security.

A few other data points from the report worth knowing if you're responsible for any organisation's security posture:

• Exploits targeting internet-facing applications nearly doubled their share of incidents in a year (15% to 24%).
• India ranks eighth globally for overall cyber threat exposure, a step up in scrutiny from prior years.
• Microsoft says it has begun recording cases of what it calls autonomous or semi-autonomous ransomware activity — malicious code making decisions about targets and timing with minimal direct human steering.

None of this means panic is the right response. It means the baseline assumptions — that a known vulnerability gives you days to patch, that MFA alone blocks credential theft, that a phishing email is recognisable by its typos — don't hold the way they used to. The organisations that come out ahead over the next year won't be the ones with the biggest security budgets necessarily, but the ones that accept the timeline has changed and stop treating patching and access reviews as back-burner chores.