AI Deepfakes & Laptop Farms: Inside the 2026 Cloudflare Threat Report
#ThisWeekinNET — Episode 122
In this episode of This Week in NET, host João Tomé is joined by Cloudflare threat intelligence experts Brian Carter and Chris Pacey to break down the 2026 Cloudflare Threat Report and what it reveals about today’s cyber threat landscape.
We discuss how threat intelligence helps organizations prioritize risks, how attackers are increasingly leveraging automation and AI tools, and why botnets, supply-chain attacks, and credential-theft campaigns continue to evolve.
The conversation explores how attackers gain initial access, how criminal ecosystems operate across infrastructure providers and services, and how AI is beginning to influence reconnaissance, social engineering, and large-scale campaigns.
We also examine geopolitical dimensions of cyber operations, the growing sophistication of phishing and identity attacks, and the role of threat intelligence in helping defenders anticipate and mitigate attacks before they escalate.
Check the full 2026 Cloudflare Threat Report:
https://www.cloudflare.com/lp/threat-report-2026/
Check the Cloudflare Blog:
blog.cloudflare.com
🎧 Subscribe to the podcast for weekly conversations about the Internet and Cloudflare:
https://ThisWeekinNET.com/
⏱️ Timestamps
00:12 — Introduction: Special 2026 Threat Report edition
00:58 — Threat Intelligence: Helping organizations prioritize defense
01:53 — Global Trends: Identity weaponization and hyper-volumetric attacks
04:44 — Record-breaking DDoS: Attack volume doubled from 2024 to 2025
05:40 — AI and cybercrime: shrinking the time from access to data theft
08:10 — Living off the Cloud: Malware hidden inside Google Calendar and OneDrive
10:43 — State-sponsored evolution: Cyber activity linked to the Ukraine war
11:28 — Persistent espionage: Chinese and Iranian state actors
13:56 — Industrialized cybercrime: Effectiveness over elegance
16:35 — The recruitment attack: Deepfakes in remote hiring processes
19:01 — Laptop farms: North Korean operators inside Western companies
21:28 — Detecting AI interviewees and “digital tics”
23:13 — Token theft: How attackers bypass MFA protections
25:40 — Human-in-the-loop phishing: Building trust before the payload
27:54 — Infrastructure rug-pulling: The “Nasty Shrew” campaign
31:52 — Advice for CISOs: Managing third-party integration risks
33:55 — Disrupting the chain: Neutralizing 400+ malicious domains in 2025