More than 150 technology, cybersecurity, and financial organizations signed a letter warning that AI-enabled attacks will become far more widespread and sophisticated in the coming months. ^[1] Thi Nguyen-Huu, CEO of WinMagic, stated that the industry uses cryptography in pieces rather than end-to-end, creating a gap between the login and the data exchange that attackers exploit. ^[2] Security researchers at Proofpoint observed a Remote Access Trojan called PackClient being actively sold on Telegram channels. ^[3] TA4922 distributed PackClient via emails spoofing local tax authorities that claimed recipients needed to conduct a 'self-inspection' by downloading paperwork. ^[4] The financially motivated hacking group TA4922 has been distributing PackClient against organizations in mainland China and India since late May 2026. ^[5] The PackClient installer provided in the emails offered advanced features including file theft, remote shell execution, screen capture, webcam access, keylogging, and privilege escalation. ^[6] WinMagic CEO Thi Nguyen-Huu said that AI is very good at deceiving people and finding flaws in complicated systems, but it is not good at breaking cryptography. ^[7] WinMagic proposed a new authentication mechanism called 'Live Key' that rests on cryptography and verifies the user, device, and local security policy without requiring any user action. ^[8]