The IT Nerd

The latest ransomware report reveals that attacks have reached an all-time high, signaling a shift from a volatile, unstable landscape to a booming market where new players regularly emerge — it’s a golden age for attackers.

● 2,894 ransomware incidents were recorded from July to September 2026, up 50% from Q3 2025 and 8.6% from Q2 2026.

● The Gentlemen and Qilin have both ramped up their activity sharply, reaching 383 and 363 attacks respectively.

● Our expert issues a warning for the last months of 2026: In Q4 2025, ransomware actors ramped up attacks, exploiting end-of-year vulnerabilities, and are likely to take advantage of seasonal weaknesses this year as well.

The latest findings from NordLayer Intelligence by NordStellar, a threat exposure management platform, reveal that ransomware attacks reached record highs in Q3 2026. Experts warn these findings show the ransomware market has moved past  its volatile, rebuilding phase and became a thriving landscape that now enables attacks at unprecedented scale.

According to findings from NordLayer Intelligence, 2,894 ransomware incidents were recorded from  July to September 2026. The number reflects a 50% year-over-year increase from the 1,933 attacks recorded in Q3 2025 and a 8.6% increase in attacks from Q2 2026 (2,664 incidents). The latest Q3 2026 attack numbers mark an all-time high for ransomware across NordLayer Intelligence’s monitoring, which dates back to 2020.

“A year ago, the ransomware ecosystem was still rebuilding after LockBit’s takedown, and the shutdowns of BlackCat and RansomHub left affiliates without a home,” says Vakaris Noreika, cybersecurity expert at NordLayer Intelligence. “Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era. The market has found its footing — going forward, it’s likely that even more new players will emerge, and attack numbers will continue to climb.”

The Gentlemen and Qilin amplify attacks

A thriving market has allowed ransomware groups to grow and new threat actors to emerge, fueling competition. Findings from NordLayer Intelligence show that two groups alone accounted for 746 attacks this quarter: The Gentlemen with 383 and Qilin with 363.

“The rivalry between The Gentlemen and Qilin plays out like a 1980s soap opera,” explains Mantas Sabeckis, cybersecurity expert at Nord Security, a global cybersecurity powerhouse. “Based on underground forum activity we observed, The Gentlemen’s founder appears to have previously run one of Qilin’s top affiliate crews before a dispute over an unpaid cut, which he took to an underground forum and lost. His answer was to start a new group and lure his former colleagues away with a 90% payout, well above the usual 70% to 80%. This quarter, the breakaway The Gentlemen group edged past Qilin by 20 attacks.”

Sabeckis notes that beyond the fight for dominance, evolving techniques are another driver of rising attack numbers. He explains that some extortion groups are skipping encryption entirely to save time.

“Stealing data is faster and simpler, so one group can hit many victims at once with far less effort,” says Sabeckis. “This shift is likely a big part of why attack volumes keep climbing. But that doesn’t mean encryption is going away. Some groups still lock files and nothing else, others combine encryption with data extortion, and a growing number, like Cl0p, skip encryption entirely, betting that the threat of a leak is enough to force the target of the attack to pay the ransom.”

A warning for the end of the year

According to data analyzed by NordLayer Intelligence, small and medium-sized businesses (SMBs) with up to 200 employees and under $25 million in revenue, operating in the manufacturing sector, remain the most targeted by ransomware attacks — a trend expected to hold through year-end as well.

“Attackers follow the money, so the strongest economies remain the biggest targets. North America accounted for almost half of all attacks we could locate, and Europe for more than a quarter, which means nearly three in four attacks hit those two regions alone,” says Sabeckis.

Noreika urges companies to stay on high alert for the remaining months of 2026. Last year, ransomware attacks peaked in Q4 as threat actors exploited end-of-year vulnerabilities and holiday staff shortages — the same seasonal weaknesses they are likely to exploit this year.

“There’s no single ransomware model to defend against anymore,” says Noreika. “INC Ransom has stayed in the top five groups all year by concentrating its attacks, hitting a run of law firms in quick succession. Akira relies on speed instead, exploiting exposed VPN credentials and weak multi-factor authentication to encrypt data within hours, a method it has used against small firms for over a year. Each approach needs a different defense, which is a heavy load for small businesses that often don’t have a dedicated security team.”

Still, Noreika notes that while attack methods are multiplying, the doors attackers use have barely changed. “The names on the most prolific ransomware group list regularly change, but the way they get in doesn’t,” he says. “Stolen logins protected by weak multi-factor authentication keep working, and known vulnerabilities in widely used enterprise products remain one of the most common entry points. What happens once attackers are inside may be shifting, but closing those familiar openings still removes a large share of the risk.”

Methodology

NordLayer Intelligence continuously monitors over 200 blogs run by ransomware groups, with incidents observed as early as 2020. Analyzing the listings published by attackers, NordLayer Intelligence discovered 2,894 ransomware attacks from July to September 2026. The full methodology can be found in the report, located here: https://nordlayer.com/intelligence/ransomware-statistics/.

ABOUT NORDLAYER INTELLIGENCE

NordLayer Intelligence by NordStellar is a next-generation threat exposure management platform that helps companies to detect and respond to cyber threats before they escalate. NordLayer Intelligence offers visibility into how threat actors work and what they do with compromised data. NordLayer Intelligence was created by Nord Security, a global cybersecurity powerhouse behind one of the world’s most popular digital privacy tools, NordVPN. For more information, visit nordlayer.com/intelligence/.

NordLayer launches NordLayer AI Scout, an AI visibility and security solution that delivers data on actual adoption, unauthorized AI use, agent connections, and security risks, with built-in AI DLP to prevent sensitive data exposure.

With AI adoption accelerating and new tools surfacing faster than IT teams can track, organizations face a growing AI blind spot — they can’t secure what they can’t see. NordLayer, a toggle-ready network security platform for business from the creators of NordVPN, launches NordLayer AI Scout, a solution that monitors AI use across web and desktop to deliver real-time visibility into unauthorized AI tools, AI adoption, agent connections, and security risks in a single pane of glass, enabling organizations to see how AI is really used and decide where controls are needed.

Businesses are ramping up AI adoption — according to Writer’s 2026 AI Adoption in the Enterprise survey, 59% of companies are investing over $1 million annually in AI technology. The pressure to put AI to work isn’t just corporate — employees are racing ahead on their own terms, often outside sanctioned channels. A University of Melbourne report found that only 42% of employees use company-provided tools, while 70% still rely on free, publicly available LLMs at work.

When employees turn to unauthorized AI tools, the security stakes rise. IBM reports that breaches involving shadow AI cost an additional $400,000 on top of the global average of $4.99 million. As a result, the true cost of the AI race isn’t just what companies invest into the adoption of authorized tools — it’s also the shadow AI exposure accumulating underneath it. 

NordLayer AI Scout is designed to close that visibility gap. It reveals every AI interaction — web and desktop — scanned on-device with zero employee friction, bringing AI tools, prompts, and agent connections out of the shadows and into a single view, so organizations can decide where to implement security controls instead of blindly blocking AI use.

The NordLayer AI Scout stands out from other LLM observability solutions through its built-in AI data loss prevention (DLP) tools that, unlike traditional DLP tools, are engineered to observe AI prompts. The solution also provides extensive visibility into the MCP servers AI agents connect to and the skills they can execute.

Key capabilities of the NordLayer AI Scout include:

• Shadow AI detection. The solution provides visibility on both sanctioned and unauthorized AI use in a single pane of glass. Organizations are provided with a clear dashboard on what native or web-based LLMs employees are using in their day-to-day work. 
• Built-in AI DLP. Traditional DLP tools were built to stop files from leaving the network, not monitor the AI chatbox. NordLayer AI Scout’s AI DLP is designed to see and control what people are typing into LLMs, and in the browser, can warn, redact, or block the prompt before an employee hands over sensitive information. 
• Full oversight of agentic AI. Enables true AI governance by moving beyond the chat and providing an inventory of the tools, connections, and knowledge that AI uses. This includes an MCP server catalog with a live view of the MCP servers that coding agents actually connect to and an inventory of skills and capabilities available to those coding agents. 
• Metrics on actual AI adoption. NordLayer AI Scout’s adoption analytics replace guesswork with evidence — measuring real usage across AI tools employees interact with, sanctioned or not, based on observed activity rather than provisioned seats. With visibility into true adoption depth, active versus paid-for licenses, and estimated token spend across all deployed LLMs, organizations can right-size AI spend and see where adoption — and risk — is really concentrated.  

The NordLayer AI Scout is now available to all organizations. For more information, visit: http://nordlayer.com/blog/introducing-nordlayer-ai-scout. 

Findings from a report from NordLayer, a toggle-ready network security platform for business, reveal that credentials of Fortune 500 employees are being leaked on the dark web at an alarming rate, with the overall number of leaked credentials reaching nearly 10 million. The numbers are accelerating in 2026 — dated infostealer logs from this year show a new Fortune 500 credential appearing on the dark web every 100 seconds.

NordLayer analyzed findings from NordLayer Intelligence by NordStellar, a threat intelligence platform, which revealed that 9.96 million Fortune 500 employees’ credentials were leaked on the dark web. The research found that over 6.6 million unique corporate email addresses were exposed. 

The leaked credential sets analyzed in the research comprise combolists — re-purposed credentials obtained from data breaches and infostealer infections — and dated infostealer logs, the only sets that record when the data was collected. 

Analysis of infostealer logs shows that 130,000 Fortune 500 employee credentials were leaked on the dark web across roughly 147 days in 2026 alone. This amounts to a new Fortune 500 credential surfacing on the dark web every 100 seconds.

“The credential leaks that could be traced down to this year were harvested using infostealer malware,” says Andrius Buinovskis, cybersecurity expert at NordLayer. “Unlike ransomware, which typically targets specific organizations, infostealer campaigns are often more opportunistic, focusing on individual users rather than entire companies. This malware primarily hides within pirated software, gaming applications, fraudulent ads, fake captchas, and phishing emails.”

Almost all credentials harvested from browsers

According to Buinovskis, infostealers scrape data from users’ devices almost immediately after infection, stealing any credentials or credit card details they come across. The browser is their preferred hunting ground for users’ log-in information — of the analyzed 2026 infostealer logs that record a source application, 99% point to browsers.

“Infostealer malware is specifically designed to extract credentials from built-in browser password managers. Because standard browsers store this sensitive data in predictable local directories, it is an easy target for malware,” explains Buinovskis. “The vulnerability of these industry giants proves that even the best corporate defenses can be bypassed by a single employee’s habits. In the face of opportunistic malware, the browser has become the enterprise’s weakest link.”

Desk-heavy industries top infostealer exposure rates

2026 infostealer data analyzed in the research shows that mid-sized Fortune 500 companies record higher infostealer exposure rates than the largest employers. Companies in the mid-sized bands (between 5,000 and 25,000 employees) record the highest median credential leakage rate — 1.27 unique credentials per 1,000 employees — while the largest employers show the lowest rates. The highest per-employee credential leak rates come from mid-sized technology companies, topping out at 42 credentials per 1,000 employees.

By industry, media and entertainment companies show the highest median credential leakage rate at 10.59 per 1,000 employees, followed by telecommunications and technology at around 3. According to Vakaris Noreika, a cybersecurity expert at NordLayer Intelligence, the rates mirror the attack surface these industries expose — sectors where nearly every employee holds a corporate login and saves credentials in a browser present infostealers with more to harvest.

“Many Fortune 500 giants employ vast numbers of frontline staff — whether on factory floors or in retail outlets — who operate without a corporate inbox, naturally lowering the company’s overall credential footprint,” says Vakaris Noreika. “At the opposite end, companies operating in the media and entertainment, telecommunications, and technology industries are almost entirely desk based, meaning nearly every employee is a potential infostealer target — and that exposure accumulates fast.” 

Safeguarding against infostealers

Buinovskis highlights five main measures companies should implement to build an infostealer-resistant cybersecurity strategy. 

1. Secure the browser. Browsers are the main hunting ground for infostealers, yet consumer-grade browsers often lack robust security measures and the ability to enforce centralized security controls. To reduce the risk of users downloading infostealers, the browser must block malicious websites and prevent users from downloading infected files.
2. Implement proper password hygiene. “Abandon built-in browser password managers and ensure that employees are not reusing the same passwords for different accounts,” says Buinovskis. “Password reuse can turn a single leak into a total compromise. If an employee uses the same login for every work application, they’re not just losing one password to an infostealer — they’re handing over the keys to every company resource at once.”
3. Raise employees’ cybersecurity awareness. Cybersecurity is everyone’s responsibility — fostering this mindset is crucial to reduce user error where possible. When an employee understands how a single pirated file or a click on a link in a phishing email can compromise the entire company, it’s easier for them to shift from treating cybersecurity incidents like an IT problem and start seeing them as their own responsibility. 
4. Monitor the dark web for any company credential leaks. This enables companies to have a heads up as soon as possible, empowering them to quickly implement necessary remediation steps, like flagging compromised accounts, resetting passwords that appeared in the data leak, and keeping a close eye on any anomalies.
5. Adopt a zero-trust approach to security to reduce the fallout. “A comprehensive cybersecurity strategy is essential to minimize the impact of a data breach,” says Buinovskis. “Instead of automatically trusting users and devices, companies should embrace a zero-trust mindset and treat every login attempt as a potential threat until proven otherwise. By verifying every move, organizations can effectively stop threat actors from infiltrating the network, preventing a simple credential leak from turning into a major security breach.”

Methodology

NordLayer and NordLayer Intelligence by NordStellar analyzed leaked credentials and identified those tied to domains belonging to 2026 Fortune 500 companies, covering 500 companies and 3,692 corporate domains. Subsidiary brands were not included. The research began with 34.86 million raw records, which were deduplicated to 9.96 million unique email and password pairs, counted once per company. Each company was matched to its industry, revenue, and headcount. The leaked sets are made up of combolists and infostealer logs, and only the infostealer logs carry a collection date. About 130,000 of those dated records fall within roughly 147 days of 2026, which works out to about 1 new credential every 100 seconds. Per-employee exposure was calculated by dividing a company’s unique leaked emails by its headcount, then scaled to a rate per 1,000 staff and grouped by company size and by industry for comparison. 

The latest findings from NordLayer Intelligence by NordStellar, a threat exposure management platform, reveal that cybercrime-related discussions are increasingly shifting to Telegram. Across seven tracked cybercrime categories on Telegram and dark web forums, the platform’s unweighted average share of discussions reached 45% in the first five months of 2026.

Telegram’s share for January-May 2026 is 61% higher than its 28% share across the whole of 2025, signaling that cybercrime chatter on the platform is escalating quickly. 

According to Vakaris Noreika, a cybersecurity expert at NordLayer Intelligence, one reason for the increase in cybercrime discussions on Telegram may be the relentless dismantling of traditional dark web forums by law enforcement. High-profile seizures of large hacker forums like LeakBase could have pushed threat actors to look for alternatives. 

“Dark web forums are essentially communities for threat actors, and they spend years building their reputation to prove the trustworthiness of their sellers,” explains Noreika. “Each time a dark web forum gets taken down, it fragments the market. The threat actor community that used the forum then scatters across other smaller forums, where the once-trusted sellers enter as new, unverified users, and find it challenging to find new potential buyers.” 

He explains that even after threat actors join a new dark web forum, they’re well aware that it could potentially meet the same fate. 

“Building credibility, and even getting accepted into a new dark web forum, requires time and effort, and with the increasing likelihood of it eventually getting shut down, some threat actors might deem the investment no longer worthwhile,” says Noreika. “Telegram operates without these complex re-registration and reputation-building processes, making it the simpler alternative.” 

A more accessible entry point for emerging threat actors

Noreika emphasizes that navigating the complex dark web infrastructure is no easy feat, especially for newcomers. Telegram, on the other hand, is a mainstream messaging platform that requires no special software or invitation to access.

“Compared with the dark web forums, Telegram presents a much lower-friction environment,” says Noreika. “Even though the platform blocked over 20 million groups and channels this year according to their official safety report, cybercriminals are quick to regroup, just as they have long done on the dark web, and doing so is far easier on Telegram.”

He suggests that the current Telegram cybercriminal ecosystem is most likely populated by newcomers who are searching for automated, mass-volume attacks to get their foot into cybercrime without the necessary skillset as well as more experienced hackers who use the platform to advertise their services or carry out lower-value deals while still keeping their main operations on the dark web.

“Despite the risks posed by ongoing law enforcement operations, the dark web offers higher operational security, and threat actors aren’t likely to trust Telegram for high-value transactions,” says Noreika. “The reputation and vetting infrastructure exists on the dark web for a reason — it’s unlikely that threat actors would carry out highly expensive and risky deals in a messaging platform that should cooperate with law enforcement.” 

Staying on high alert for scalable attacks

According to Noreika, the findings of increasing cybercrime discussions on Telegram illustrate that cybercriminals are quick to adapt and are a reflection of the changes in the current cyberthreat landscape, which has experienced an influx of newcomers deploying low-skill, yet high-volume attacks. 

“This shift doesn’t necessarily signal a wave of more sophisticated attackers, but a growing number of lower-skilled threat actors using easily accessible tools to launch high-volume campaigns,” says Noreika. “That means staying on high alert for threats such as phishing, credential theft, account takeover attempts, denial-of-service-for-hire activity, and deepfake-enabled fraud, all of which can be scaled quickly and deployed with limited technical expertise.”

He recommends users and organizations re-evaluate their cybersecurity hygiene, ensuring that they use unique passwords for all accounts and don’t store them in built-in browser password managers, and that multi-factor authentication is enabled wherever possible. Software and systems should be kept up to date with the latest patches, and publicly available personal information should be kept to a minimum to reduce the material that attackers can use for social engineering or deepfake creation.

“If cybercriminals manage to get a hold of credentials or other sensitive information, it’s crucial to act as soon as possible,” says Noreika. “Deep and dark web monitoring can provide alerts of many instances of leaked data, allowing for the detection of leaks across both Telegram and multiple dark web forums. This visibility is key to initiating urgent responses — such as changing passwords, revoking access from compromised accounts, and staying on high alert for any signs of further escalation.”

Methodology: Nordayer Intelligence analyzed monthly post counts across dark web forums and Telegram channels monitored by the NordLayer Intelligence platform, covering seven popular cybercrime categories from January 2024 to May 2026. Between January 2024 and May 2026, 86 dark web forums and 1,890 Telegram channels were monitored. As new sources emerged and others were shut down or seized during this period, year-on-year comparisons reflect changes in activity alongside shifts in the source pool itself. “Share” refers to the average proportion of posts across the seven tracked cybercrime categories, calculated by measuring Telegram’s share of posts in each category separately and then averaging those figures. 2026 figures cover January–May only.

Findings are limited to NordLayer Intelligence’s monitored sources and are not representative of all activity on Telegram or the dark web. Post counts measure discussion volume, not confirmed criminal activity or victims. Only aggregate counts were analyzed; no personal user data was collected. For more information, visit NordLayer Intelligence’s blog post.

Disclaimer: This analysis is provided for general information only and does not constitute legal, security, or professional advice, nor any guarantee of security or outcome. It reflects activity detected within NordLayer Intelligence’s monitored sources during the stated period and describes aggregate patterns only – no conclusion is drawn about any identified individual or organisation. References to third-party platforms and services are for identification and factual reporting only and do not imply any wrongdoing by, endorsement by, or affiliation with those parties. All third-party trademarks remain the property of their respective owners.

As individual users and organizations are increasingly adopting AI, cybercriminals are not lagging behind. New dark web analysis from NordLayer, a toggle-ready network security platform, reveals that dark web discussions surrounding AI surged at the beginning of 2026, and dark web posts discussing AI and cybercrime are following an alarming upwards trajectory.

NordLayer analyzed data from NordStellar, a threat intelligence platform, and found that dark web user discussions surrounding AI spiked in February 2026, following the release of Claude Opus 4.6. Compared to a month prior to the release, the number of posts mentioning AI on dark web forums increased by 44%.

The data reveals that the Claude Opus 4.6 release coincided with the biggest surge on record, far above the average increase of around 11% observed around previous large language model (LLM) releases. Previous releases were followed by temporary spikes that eventually subsided. The Claude Opus 4.6 release, however, appears to have elevated the baseline itself — discussions have remained strong at around 2,518 posts per month with no sign of dropping back to pre-release levels.

“Today’s cybercriminals are highly opportunistic — they most likely monitor new releases to gauge potential impact and shifts in the digital ecosystem. The pre-release baseline for Claude Opus 4.6 was already elevated — a reflection of how normalized AI has become as a topic across all online communities, including underground forums,” says Andrius Buinovskis, cybersecurity expert at NordLayer. “The additional spike likely reflects the broader cultural moment. This release came at a point of intense public debate around AI capabilities, safety, and regulation, and it goes to show that these conversations don’t stay on the surface web.”

How cybercriminals are utilizing AI

The findings reveal that the baseline for dark web discussions surrounding AI and cybercrime has also been steadily increasing, now averaging around 500 posts per month. Phishing dominates the landscape of AI-related dark web activity. The 303 posts recorded through January-May 2026 represent 61% of the 497 posts seen in all of 2025, signaling a sharp year-over-year acceleration.

“When it comes to phishing, AI is instrumental to eliminating the initial red flags — before the rise of LLMs, users would often identify scammers through poor grammar and awkward phrasing,” explains Vakaris Noreika, cybersecurity expert at NordStellar. “AI enables even non-native speakers to craft highly convincing messages. Furthermore, LLMs allow accelerated personalization for massive scale attacks, tailoring hundreds or even thousands of phishing emails and messages by including various personal information that was scraped from public databases, like social media profiles.”

The data highlights another interesting trend — despite the rise in general AI discussions, mentions of branded malicious AI tools like WormGPT and FraudGPT totaled just 155 in 2025 and 93 in the first five months of this year — a stark contrast to the growth seen in broader categories.

“It seems that cybercriminals have realized that jailbreak versions of traditional AI tools are more powerful than custom-built malicious solutions,” says Noreika. “Malicious AI tools are very niche, and they lack the same level of training that’s present in widespread LLMs.”

Ramping up defenses against AI-powered cybercrime

According to Buinovskis, the analysis of dark web discussions surrounding AI is a clear indicator that while AI adoption is rising, cybercriminals are following fast behind. He says that users and organizations can expect an increase in attacks and urges them to prepare for the new AI-powered cyber threat landscape.

“Highly convincing, mass-volume attacks are becoming the new baseline,” says Buinovskis. “It’s now easier than ever to become a cybercriminal — technical skills are no longer a necessity. Users and organizations are getting hit from both sides. Veteran hackers are utilizing AI to scale their operations, and a whole new wave of beginners is joining the ranks every day.”

He says that in the new age of massive attacks, anyone can become a victim. Buinovskis emphasizes that, especially now, vigilance and awareness are key.

“A cautious approach is now more vital than ever — spotting AI and AI-powered attacks can be difficult even for seasoned cybersecurity experts,” says Buinovskis. “These attacks are designed to bypass both filters and human intuition, especially when we’re rushed. My key recommendation is to step back and critically assess any message that pushes to act now. In the age of AI, a healthy dose of skepticism is our first wall of defense.”

Despite that, Buinovskis explains that eventual user error is inevitable. Having proper security guardrails in place helps to minimize the possibility of a data breach and fallout of a cyberattack.

“Regarding AI-powered cyberattacks, solutions that identify malicious websites and block malware download attempts are the first step,” says Buinovskis. “For organizations, this must be part of a more comprehensive approach. True resilience requires a zero-trust architecture that treats every access request as a potential threat, combined with proactive dark web monitoring to identify leaked data before it can be weaponized.”

Buinovskis highlights that while cybercriminals are ramping up operations with AI, the fundamental attack vectors remain the same. This makes basic cybersecurity hygiene more critical than ever. Effective defense starts with rigorous password management — avoiding reuse and moving away from vulnerable consumer-browser password managers, while remaining aware of the digital footprint left behind through publicly available personal information, which attackers now routinely exploit to personalize social engineering attacks.

Methodology

NordLayer and NordStellar analyzed dark web activity between January 2024 and May 2026, tracking keyword-specific discussions across underground forums and Telegram. The research focused on the volume of AI-related mentions and how these trends shifted in direct response to major LLM product releases, with release dates sourced from public records.

Disclaimer. This analysis is based on detected activity and is for informational purposes only. It does not constitute professional advice or a guarantee of security. All third-party trademarks and references remain the property of their respective owners and are used for identification purposes only. This research tracks discussion trends in deep and dark web spaces and does not assess the safety, security, or intent of any AI provider or product.

NordLayer has released the Why Browser Security Can’t Wait: Web-based Threats Report 2026. The findings show that as work applications increasingly shift to the browser, attackers are shifting with them — 82% of surveyed IT professionals report their organization experienced a web-based security incident in the past year, with half describing the impact as moderate or severe.

Organizations that experienced significant-impact incidents follow distinct patterns: They more often allow bring-your-own-device (BYOD) policies (85% vs. 60% overall), have employees who primarily use their own devices (51% vs. 31%), rely more extensively on SaaS tools (56% vs. 31%), and have established fully or primarily remote work policies (35% vs. 17%).

Expectations vs. reality

Despite frequent incidents, 73% of IT professionals say their organization is well prepared — yet their own responses tell a different story. Coverage is modest and uneven: Data loss prevention (DLP) tools lead at just 53%, with other browser security controls trailing below that mark. Nearly all IT professionals report that their organizations are concerned about web-based threats (98%), and most expect escalation — 81% foresee greater sophistication and 73% anticipate more incidents over the next few years.

“There’s a clear gap between recognizing the threat and knowing how to address it,” says Buinovskis. “Concern is high, but awareness of which controls actually solve browser-specific risks is low. Much of the initial confidence most likely comes from having general security controls in place, yet they rarely adequately cover risks in the browser.”

NordLayer’s analysis of 504 unique, highest rated and most reviewed applications listed on  51 unique software categories on Gartner® Peer Insights™, a community-driven software review platform, found that 100% of the applications were browser accessible and 78.8% were browser only (Full methodology located here). Meanwhile, data analyzed by NordLayer and NordStellar, a threat exposure management platform, shows that infostealer malware harvested around 1.8 million credentials and nearly 68.8 billion cookies in 2025, peaking in November.

“Hackers don’t hack anymore, they just log in,” says Buinovskis. “Stolen cookies and credentials grant immediate access without raising alarm bells — a login looks legitimate. It’s low risk, high reward, and as reliance on web-based SaaS grows, so does the value of stolen data. Attackers will keep exploiting this until organizations secure the browser as a critical boundary.”

Practical steps to protect the browser

Buinovskis highlights three priorities for organizations looking to strengthen browser security.

1. Establish observability. Security administrators need visibility into what SaaS tools employees are using, what browser extensions are installed, and whether employees are visiting malicious or unauthorized websites. This minimizes shadow IT and reduces the risk of accidental malware downloads or data exposure.

2. Proactively block threats. Use domain name system (DNS) filtering to block access to malicious content or specific website categories like AI tools or gambling, and deploy data loss prevention (DLP) tools to restrict file uploads, downloads, and copy/paste functions — especially where employees handle personal or financial data.

3. Adopt a zero-trust approach. “Trust can’t be considered inherent — every user needs to be verified,” says Buinovskis. “Applying zero trust allows security administrators to implement network segmentation at the browser level, ensuring employees only access necessary resources and infiltrators are denied entry.”

To read the full Why Browser Security Can’t Wait: Web-based Threats Report 2026, please visit: https://nordlayer.com/browser-research-report/.

NordLayer has officially launched the NordLayer Browser — an enterprise-grade solution tailored to small and medium-sized businesses (SMBs). To safeguard company operations, it integrates browser-native security, enhanced observability, and access management and control into a single platform, delivering a familiar and intuitive experience for users with effortless deployment and management for businesses.

Leading research and advisory firm Gartner predicts that by 2028, 25% of organizations will deploy at least one secure enterprise browser technology to address specific gaps in their cybersecurity strategy. Gartner also predicts that by 2030, enterprise browsers will be the core platform for workforce productivity and security software on managed and unmanaged devices for a seamless hybrid work experience. These predictions are a direct response to cybercriminals frequently targeting employees via web-based and SaaS-use related attacks, like phishing, malicious browser extension campaigns, and account takeovers, that call for an additional layer of control and visibility within the browser.

The lack of dedicated IT staff, coupled with limited cybersecurity budgets, makes SMBs an attractive target for cybercriminals. A report from NordStellar, a threat exposure management platform, revealed that SMBs — companies with up to 200 employees and revenues up to $25 million — bore the brunt of all ransomware attacks last year.

Key solutions of the NordLayer business browser include:

• Shadow IT management. The browser provides visibility into SaaS usage and helps mitigate shadow IT activity through web activity monitoring, browser extension tracking, domain blocking, and a comprehensive activity log.
• Browser data loss prevention (DLP) elements. DLP elements restrict camera, microphone, file downloads, and clipboard access to prevent data capture and exfiltration on untrusted websites. This helps organizations limit uncontrolled data movement and reduce the risk of data leaks.
• Secure browsing capabilities. The browser enhances security through IP anonymization to hide the user’s address as well as web threat protection that blocks malicious or deceptive websites before they load. Category-based DNS filtering further restricts access to websites based on predefined categories for safer browsing.
• SaaS access control. The NordLayer Browser secures access through single sign-on (SSO) and multi-factor authentication (MFA) to prevent unauthorized access and maintain compliance. A dedicated IP feature enables IP-based control for internal and SaaS applications, while administrators can configure access to internal websites via a private gateway with a fixed, allowlisted IP address for secure connectivity.
• Zero-trust browsing. The browser securely manages how the browser traffic flows and what users can access. It routes traffic through approved gateways, provides secure tunnels to private resources, and enables security administrators to allow or block connections to internal and cloud services.

The NordLayer Browser is now available to all organizations. For more information, visit https://nordlayer.com/browser/.

In 2025, the corporate world witnessed a significant rise in artificial intelligence adoption, leading to a boom in AI-powered browsers, co-pilots, and personal assistants. However, Andrius Buinovskis, cybersecurity expert at NordLayer, a toggle-ready network security platform for business, emphasizes that cybercriminals were quick to adopt AI as well, automating and scaling their attacks, and this trend is projected to continue into the next year.

Buinovskis explains that in 2026, businesses can expect to see even more AI-powered cyber threats, alongside other risks that have persisted and will continue to challenge business cybersecurity in the new year. He outlines four main cybersecurity threats businesses should be on the lookout for in 2026.

1.     AI-powered social engineering and AI-enabled malware

According to a report by the World Economic Forum, phishing and social engineering attacks increased by 42% in 2024. According to Buinovskis, the uptick that AI might have caused is likely to worsen.

“Social engineering is the basis for many attacks, and with AI, it’s bound to get more advanced,” Buinovskis says. “It will  become increasingly more difficult to understand if an attack is being carried out using a sophisticated method or a simple approach. Essentially, the line between basic and advanced social engineering is blurring, making both its detection and resistance significantly more difficult.”

He outlines automated deepfake social engineering as a primary growing concern. Utilizing it, cybercriminals will be able to carry out even more believable attacks, tricking even the most well-prepared employees.

“The use of deepfakes is becoming increasingly more common and diverse, with some instances of students even using deepfakes for exams,” says Buinovskis. “Bad actors could definitely utilize highly believable videos and voice calls to impersonate CEOs, third-party contractors, or other employees to trick staff members into divulging sensitive information, accepting fake invoices, or handing over credentials to infiltrate the network and deploy a larger-scale attack.”

Buinovskis highlights AI-enabled malware as another rising threat to cybersecurity. Recently, Google identified the first instance of Just-in-Time (JIT) AI malware, a new type of malware that utilizes artificial intelligence to dynamically generate malicious code at runtime, making it highly adaptable and challenging to detect.

“JIT can generate malicious code dynamically, flying under the radar of traditional antivirus software that relies on static analysis,” says Buinovskis. “Its ability to analyze the target’s system in real time and dynamically generate malicious code tailored to specific vulnerabilities, configurations, or data enables it to deploy highly targeted attacks.”

2.     An increase in ransomware

According to research by NordStellar, a threat exposure management platform, as of September 2025, the number of ransomware incidents has increased by 47% compared to the same period last year. Buinovskis says that the trend will most likely continue into the following year, especially with the introduction of AI-powered ransomware.

“Like other cybercriminals, ransomware groups are adopting AI and using it to scale their operations by automating the attacks,” Buinovskis says. “We’ve already seen how the rise of the ransomware-as-a-service model lowered the entry barrier for these attacks, allowing even hackers without the proper technical skillset to participate. With AI, ransomware groups will be able to cut down on the required human resources needed to carry out their operations, enabling them to execute attacks more quickly and efficiently.”

He emphasizes that if ransomware groups successfully implement AI and increase their efficiency, they will be able to reap the same profits with fewer human resources, resulting in a greater financial gain. This, Buinovskis notes, could be the catalyst for an even greater ransomware surge in the longer run.

3.     Web-based attacks

Malicious browser extensions were a prominent cybersecurity topic in 2025, raising concerns over browser protection. However, they’re not the only browser-related threat to look out for — according to Buinovskis, the browser has become a substantial attack surface and the primary target for many dangerous attacks.

“As companies continue to adopt web-based software as a service and abandon the desktop for the web, the cyber risks that are waiting for employees in the browser are becoming increasingly more prominent and common,” says Buinovskis. “Malicious extensions, various phishing pages, and infostealer malware are some of the main threats lurking in the browser, which is becoming the default channel for work-related tasks in many organizations.”

Buinovskis emphasizes that despite many organizations shifting to a browser-based working environment, it’s still often left unprotected. As a result, more employees and organizations will be exposed to malware, browser-based exploits, and data loss caused by employees unintentionally leaking information from web-based software-as-a-service platforms.

4.     Insider threats

A study found that 83% of organizations reported having experienced at least one insider attack in 2024. Moreover, they were identified as the cause for the costliest data breaches in 2024 in an annual report by IBM, with an average cost of $4.99 million per incident.

Buinovskis explains that insider threats are complex, and as companies’ attack surfaces constantly expand due to remote or hybrid work models and the introduction of shadow IT and shadow AI, the threat will continue to escalate.

“With so many factors contributing to the complexity of the current cyber environment, it’s becoming increasingly more difficult to ensure high observability into what users are doing and prevent them from bypassing security policies,” says Buinovskis. “As a result, insider activity can go undetected for a significant amount of time, allowing for more devastating cyber incidents. The current cybersecurity landscape, as well as the constant evolution and sophistication of threats, will ultimately lead to more cybersecurity incidents caused by user error, turning more employees into unintentional insiders.”

Buinovskis emphasizes that to safeguard against the cyber threats looming in 2026, businesses should prioritize building a comprehensive cybersecurity strategy and raising employees’ cybersecurity awareness. He highlights that small businesses — often operating with limited IT budgets and facing more security vulnerabilities — should reassess their cybersecurity policies because they are frequently the primary targets of cybercriminal activity.   

Is the biggest business enemy actually on the inside? Cybersecurity expert explains why insider threats are getting harder to control in browser-first working environments

As trusted members of an organization, employees can inadvertently or maliciously engage in risky cybersecurity behavior that is harder to detect and lead to data breaches that can cost millions of dollars to remediate. Andrius Buinovskis, a cybersecurity expert at NordLayer, says that as more companies adopt a browser-first approach, mitigating insider threats will become even more challenging due to the limited visibility security administrators have into employee activity within the browser.

Cybersecurity risks that originate from within a company are referred to as insider threats. The term encompasses all threats emerging from dangerous employee activity, whether intentional or not. Deliberate employee actions — such as selling confidential data to competitors or leaking private information out of spite — are also called malicious insider threats.

In their most recent annual report, IBM found that malicious insider threats were the cause of the most financially devastating data breaches in 2024, with an average cost of $4.99 million per incident. Buinovskis explains several reasons why these cybersecurity incidents can pack a hefty punch.

“Employees have access to incredibly sensitive data and resources which, when leaked, can have devastating consequences to a company’s reputation, result in GDPR fines, or be used for ransomware demands,” says Buinovskis. “Insider threats pose a significant danger due to their high impact, but they’re also harder to detect. Employees are trusted members of the organization, and their malicious actions can blend in with usual activity, potentially going unnoticed for months.”

Insider threats lurking in the browser

Buinovskis highlights that spotting malicious activity inside the organization has become even more challenging due to the rise of web-based software as a service (SaaS) applications.

“Consumer-grade browsers do not offer security admins a comprehensive view into employee activity, creating the perfect environment to carry out malicious activities without getting caught,” says Buinovskis. “As a result, the risk of data exfiltration, sharing credentials and confidential information, data theft, unauthorized web application use, and even sabotage by deleting or modifying critical information are all amplified in cloud-first, browser-heavy working environments.”

He explains that in traditional IT environments, these threats can be mitigated by ADR (automated detection and response) and XDR (extended detection and response), which observe network connections, file-based systems, and desktop applications. However, their observability of browser activity is very limited — for example, they cannot distinguish between normal work tasks and data exfiltration or which records were accessed or downloaded.

Additionally, consumer-grade browsers do not offer the possibility of enforcing centralized security controls. Consequently, employees can act as they please: download malicious browser extensions, screenshot or copy sensitive data, and share it with outside parties — all of which can lead to devastating data breaches.

“Companies are shifting to a browser-based working environment for greater efficiency and collaboration; however, as the reliance on the browser continues to grow, so will the cyber risks,” says Buinovskis. “This is especially true for small to medium businesses that might not even have had robust ADR and XDR solutions in the first place and now, consequently, have even less observability into their employee activity.”

Buinovskis explains that investing in cybersecurity awareness training for employees is the first step in mitigating unintentional insider threats. However, he emphasizes that businesses need to have comprehensive defenses in place to safeguard against employee error and malicious insiders.

“The longer malicious employee activity remains undetected, the greater its impact and the more extensive the resulting damage. This underscores the importance of robust observability and rapid incident response,” says Buinovskis. “Companies must prioritize strict access controls, strong user authentication, and continuous employee activity monitoring to mitigate insider threats effectively. For organizations operating in a web-based SaaS environment, leveraging the built-in security tools and enhanced observability of an enterprise browser is essential for comprehensive protection.”

ABOUT NORDLAYER

NordLayer offers reliable connection, protection, threat detection, and response for businesses needing strong network security. Built on NordVPN standards, NordLayer is a trusted cybersecurity platform that integrates easily with any network and technology stack, all with unmatched support. NordLayer is part of the cybersecurity powerhouse Nord Security. For more information: https://nordlayer.com/

As more companies embrace remote work and “workations” during the summer,  a cybersecurity expert warns that swapping the office for scenic views could put corporate data at serious risk

Businesses are adopting mixed work models, and summer is the perfect time to embrace greater workplace flexibility. However, when employees swap the office for a more relaxing setting, it can expose enterprises to additional cybersecurity risks — and, without proper measures, increase the likelihood of a data breach.

A survey by DayForce has found that 41% of employees feel they’re less productive in the summer, and 58% stated that their employer offers some type of flexibility during this time, including increased work-from-home or work-from-anywhere options. According to Andrius Buinovskis, a cybersecurity expert at NordLayer, a toggle-ready cybersecurity platform for business, while employees might appreciate the added benefits, enterprises mustn’t underestimate the risks behind such perks.

“Many companies offer mixed working models, such as remote or hybrid working. Work from anywhere or ‘workations’ allowing employees to work from abroad have also gained popularity,” says Buinovskis. “This additional flexibility is a great bonus for employees. However, businesses mustn’t offer it to employees without knowing the risks. Remote work opens the door for an array of security vulnerabilities, which, if exploited, can lead to devastating data breaches, resulting in reputational and financial loss.”

The main cybersecurity risks

Buinovskis explains that the most common threat from remote work comes from using unsecured public networks. Cybercriminals can intercept Wi-Fi to steal employee credentials, install malware, or hijack accounts.

“Employees that change their routines are more likely to reduce VPN usage due to distractions. Due to their unfamiliarity with the environment, they’re also an attractive target for scammers, and their lack of vigilance can make them more likely to fall for phishing scams in general,” says Buinovskis. “Additionally, employees may be asked to share more personal data in countries with fewer GDPR restrictions, increasing the risk of misuse. Another major concern is that if they use  personal devices, those devices lack centralized security, may run outdated software, and are more vulnerable to attacks.”

He emphasizes that personal devices offer less physical security than company-issued hardware since friends and family members can access them. While travelling, work devices are also at a greater risk, as they may be lost or stolen. If that happens, the information stored on these devices could be misused, and according to Buinovskis, just one compromised device or account is enough to trigger a significant data breach.

How to ensure cybersecurity while maintaining flexibility

Even though remote work models come with cybersecurity challenges, it doesn’t mean that businesses should abandon these perks altogether. According to Buinovskis, the main cybersecurity measures companies should implement to ensure that their data is protected include:

●       Strong network encryption. It secures data in transit, transforming it into an unreadable format and safeguarding it from potential attackers.

●       Password management policies. Hackers can easily target and compromise accounts protected by weak, reused, or easy-to-access passwords. Enforcing strict password management policies requiring unique, long, and complex passwords, and educating employees on how to store them securely minimizes the possibility of falling victim to cybercriminals.

●       Multi-factor authentication. Access controls, like multi-factor authentication, make it more difficult for cybercriminals to access accounts with stolen credentials, adding a layer of protection.

●       Zero trust architecture. The constant verification process of all devices and users trying to access the network significantly reduces the possibility of a hacker successfully infiltrating the business.

●       Network segmentation. If a bad actor does manage to infiltrate the network, ensuring it’s segmented helps to minimize the potential damage. Not granting all employees access to the whole network and limiting it to the parts essential for their work helps reduce the scope of the data an infiltrator can access.

“High observability into employee activity and centralized security are crucial for defending against remote work-related cyber threats, especially because personal devices and unauthorized applications greatly expand a company’s attack surface,” Buinovskis says. “Given the real risk of data breaches and the financial and reputational damage they could potentially cause, overlooking security gaps is a serious gamble that isn’t worth taking.”

Buinovskis also emphasizes that employees are often the weakest link in a company’s cybersecurity. Cybersecurity awareness training is essential to minimize the risk of data breaches — regardless of the work model. This training should cover how to recognize phishing scams, the risks of using public Wi-Fi, and effective password management practices.

ABOUT NORDLAYER

NordLayer offers reliable connection, protection, threat detection, and response for businesses needing strong network security. Built on NordVPN standards, NordLayer is a trusted cybersecurity platform that integrates easily with any network and technology stack, all with unmatched support. NordLayer is part of the cybersecurity powerhouse Nord Security. For more information: https://nordlayer.com/