Microsoft warns of immediate AI-powered cyber threats to India

The current state of cyber threats

Nicholas Butts, the Director of AI and Cybersecurity Policy at Microsoft, recently spoke at the NDTV World Summit 2026 in New Delhi. During his presentation, he emphasized that the dangers posed by artificial intelligence are not a distant problem for the next decade. Instead, he argued that these security risks are active and present in the current technological landscape.

Butts provided a stark look at India's position in the global digital landscape. He noted that India currently ranks as the seventh most targeted country in the world regarding cybersecurity. Furthermore, the country sits as the third most targeted nation within the Asian continent.

To illustrate the scale of the problem, Butts described the situation using a "leaky roof" analogy. He suggested that the infrastructure protecting digital assets is already under pressure. The goal of his talk was to move the conversation away from hypothetical fears and toward the immediate reality of modern cyber warfare.

How Microsoft monitors the web

To understand the scope of these threats, Microsoft relies on a massive amount of data collection and analysis. Butts shared that the company processes approximately 165 trillion telemetry signals every single day. Telemetry refers to the automated data collected from devices and software to monitor performance and security.

The company's defense systems are tasked with handling an enormous volume of daily traffic. Specifically, Microsoft screens about 5 billion emails every day to identify malicious content. They also work to block roughly 5 million net-new malware files on a daily basis to keep users safe from infection.

This massive scale of data gives the company what Butts called a "unique vantage point" on global security. By analyzing such a high volume of signals, they can identify patterns that might be invisible to smaller organizations. This data allows them to spot the emergence of new threat actors and the specific tools they use to conduct attacks.

State-sponsored AI espionage

One of the primary concerns raised during the summit involved state-sponsored actors, particularly those linked to China and Russia. Butts highlighted how these entities are increasingly incorporating AI agents into their espionage campaigns. These agents are software programs that can perform tasks autonomously, making them more efficient for gathering intelligence.

He specifically identified a Chinese state-sponsored actor known as 'Storm 0940'. According to a threat intelligence report published by Microsoft on October 22, this group is primarily focused on data theft and espionage. The use of AI allows these actors to navigate networks and extract sensitive information with greater speed and less human intervention.

Another example provided was 'Storm 3168', also known as Jadepuffer. This is a ransomware organization based in China that utilizes AI agents to conduct attacks against customers worldwide. By using AI to automate the delivery and execution of ransomware, these groups can scale their criminal operations to reach a much broader audience.

The rise of autonomous crime

Beyond state-sponsored threats, Butts warned that independent cybercriminals are also becoming significantly more capable due to AI. He pointed to a group called 'EvilTokens' which emerged in February. This group consisted of only two individuals who were able to build a sophisticated criminal infrastructure using both open-source and closed-source models.

These individuals used a method called "vibe-coding" to develop their tools. This refers to a style of coding where the user describes the desired outcome in plain language, and the AI generates the necessary code. This lowered the barrier to entry for creating complex tools that were previously only accessible to highly skilled engineers.

The 'EvilTokens' group created a totally autonomous criminal infrastructure that sold access to expensive cyber tools. They offered a first-time purchase price of $1,500 and a monthly subscription of $500. This infrastructure impacted more than 10,000 organizations across 120 different countries, demonstrating how easily AI can be used to democratize cybercrime.

What this means for the future

The shift toward AI-driven cybercrime means that the speed of attacks is accelerating. When criminals can use AI agents to conduct espionage or ransomware, they can strike multiple targets simultaneously. This puts a significant strain on traditional security measures that were designed to stop human-led attacks.

For organizations in India and elsewhere, the threat is no longer just about individual hackers. It is about organized groups and state actors using automated systems to steal data. These actors are leveraging the same AI tools that are being developed for productivity to instead find vulnerabilities and exploit them at scale.

As these technologies become more accessible, the line between high-level state warfare and common street crime blurs. The fact that two individuals could impact 10,000 organizations shows that the threat is decentralized. Security experts will need to focus on detecting these autonomous agents rather than just blocking individual pieces of malware.