AI Deepfakes & Laptop Farms: Inside the 2026 Cloudflare Threat Report

In this episode of This Week in NET, host João Tomé is joined by Cloudflare threat intelligence experts Brian Carter and Chris Peacey to break down the 2026 Cloudflare Threat Report and what it reveals about today’s cyber threat landscape.

We discuss how threat intelligence helps organizations prioritize risks, how attackers are increasingly leveraging automation and AI tools, and why botnets, supply-chain attacks, and credential-theft campaigns continue to evolve.

The conversation explores how attackers gain initial access, how criminal ecosystems operate across infrastructure providers and services, and how AI is beginning to influence reconnaissance, social engineering, and large-scale campaigns.

We also examine geopolitical dimensions of cyber operations, the growing sophistication of phishing and identity attacks, and the role of threat intelligence in helping defenders anticipate and mitigate attacks before they escalate.

Check the full 2026 Cloudflare Threat Report

⏱️ Timestamps 00:12 — Introduction: Special 2026 Threat Report edition 00:58 — Threat Intelligence: Helping organizations prioritize defense 01:53 — Global Trends: Identity weaponization and hyper-volumetric attacks 04:44 — Record-breaking DDoS: Attack volume doubled from 2024 to 2025 05:40 — AI and cybercrime: shrinking the time from access to data theft 08:10 — Living off the Cloud: Malware hidden inside Google Calendar and OneDrive 10:43 — State-sponsored evolution: Cyber activity linked to the Ukraine war 11:28 — Persistent espionage: Chinese and Iranian state actors 13:56 — Industrialized cybercrime: Effectiveness over elegance 16:35 — The recruitment attack: Deepfakes in remote hiring processes 19:01 — Laptop farms: North Korean operators inside Western companies 21:28 — Detecting AI interviewees and “digital tics” 23:13 — Token theft: How attackers bypass MFA protections 25:40 — Human-in-the-loop phishing: Building trust before the payload 27:54 — Infrastructure rug-pulling: The “Nasty Shrew” campaign 31:52 — Advice for CISOs: Managing third-party integration risks 33:55 — Disrupting the chain: Neutralizing 400+ malicious domains in 2025