What's new in Island AI Threat Intelligence

In May 2026, researchers at XLab found that attackers had broken into more than 700 sites running Ghost, a popular publishing platform, through a database injection flaw disclosed in February. The attackers rewrote articles to show a fake human verification check. Visitors who followed its three steps pasted a command that installed malware, and by mid-May the final payload had zero detections from antivirus engines. The victims ranged from personal blogs to software companies to several well-known university sites. Each one kept its domain, its certificate, and its readers, so a reputation feed had nothing to flag.

Legacy threat intelligence was built for a slower world. For two decades it asked "has anyone seen this before?" Island AI Threat Intelligence asks what a page is and what it does. It runs inside Island, judges every page by its behavior on the device as it loads, and applies the same judgment whether a person or an AI agent is browsing. Each verdict becomes new intelligence. AI agents then review what happened and turn what they find into a fix, in machine time.

Where reputation runs out

Reputation-based threat intelligence came in two generations. Web categorization sorted domains into a fixed taxonomy and enforced policy with a lookup. Dynamic risk scoring trained classifiers on URL features, Domain Name System (DNS) behavior, IP and autonomous system number (ASN) reputation, domain age, Transport Layer Security (TLS) certificates, hosting patterns, and redirect chains. The second generation was a real advance. Both still score metadata about a page instead of the page itself, and both need a victim before a sample gets a label.

Attackers work in that gap. They use AI to write phishing lures tuned to each target's language and brand. Domains live for hours, long before a feed sees them. Island's research on PHP2Shell, a pair of PHP flaws disclosed in October, found that roughly a third of the web runs PHP versions that no longer get security updates, and each of those sites can host a lure. A lookup has nothing to say about these pages. To work, though, the page still has to do something. It has to draw a sign-in form that looks like Microsoft's, relay credentials through a reverse proxy, or write a command to the clipboard. Dynamic Phishing Protection looks for that behavior on the first visit. Compromised WordPress sites, content delivery networks (CDNs), and pages on trusted software as a service (SaaS) hosts all have clean reputations. Adversary-in-the-middle (AiTM) kits steal the session cookie, so multifactor authentication (MFA) does not stop them. ClickFix lures, AiTM session theft, fake CAPTCHA pages, and malicious extensions work regardless of the reputation score.

The numbers show how fast this moved. Microsoft's Digital Defense Report 2025 found that AI-written phishing drew a 54% click-through rate, against 12% for lures written by people, and that ClickFix accounted for 47% of initial access in the incidents Microsoft Defender Experts could trace to a starting point. KnowBe4 reported in April 2026 that 86% of the phishing attacks it analyzed over the prior six months were AI-driven. Mandiant's M-Trends 2026 puts the mean time to exploit at minus seven days, so attacks typically began before a patch existed. The cost of an exploit is collapsing too. In September 2026, Anthropic reported that GLM-5.3-Flash, a freely downloadable model, built a working exploit for a known Chrome V8 flaw for $20.40 in compute. AI agents add exposure of their own: when Island scanned 33,563 public Model Context Protocol (MCP) servers, more than a third had a high or critical severity finding.

Every day is a zero day

Threat intelligence feeds assume there is time: time to see a sample, label it, and push the label out. That window keeps shrinking. Zero Day Clock, which tracks known exploited vulnerability catalogs, counted 141 of the 491 Common Vulnerabilities and Exposures (CVE) records newly listed as exploited in the first half of 2026 as already exploited on the day they went public. In the latest quarter, that count reached 155% of the same quarter a year earlier.

Island treats every day as a zero day. A page has to be judged on its first visit, by what it does, before any feed has a label for it.

What's new

Verdicts built from every signal

Each decision weighs three groups of factors at once. The first is the request itself: the URL and domain, the structure and behavior of the page as it renders, the file being downloaded, and the content headed for the clipboard. The second is what Island already knows about it, from local indicator lists, premium external feeds, indicators of compromise (IOCs) from Island's own research, past verdicts, and anomaly baselines. The third is who is asking and from where: the user's identity, whether a person or an AI agent is acting, device posture, the session, and how sensitive the target app or data is.

Many sources, weighed together

No single research team sees every threat. Each one has its own sensors, its own customers, and its own queue. Island's URL classification combines multiple classification feeds with Island's in-house threat research team, and its file checks query numerous threat intelligence feeds by file hash and URL. The model works for the same reason open source often outpaces a single vendor: more contributors see more of the problem, and each one covers gaps the others leave.

Island adds two sources that no outside feed has. One is what the page does as it renders. The other is the set of verdicts Island's own control points have already made.

Enforcement on the device

Verdicts happen in the browser and on the device, where the traffic already is. The common case needs no backhaul to a cloud proxy, no break-and-inspect TLS, and no extra hop. Island makes the decision at the control point where the request starts, whether that is the Island Enterprise Browser, Island Extension, Island Desktop, or Island's network layer.

Dynamic Phishing Protection

Island reads the page as it renders, from its structure and layout to what its scripts do. A proxy in the cloud sees a URL and encrypted traffic. Island runs inside the browser engine and on the device, so it sees the same page the user sees, at the moment the user sees it. The same analysis applies when an AI agent loads the page on an employee's behalf.

Island dynamically analyzes that page to find the patterns of an attack. A sign-in form styled like Microsoft's, served from a domain Microsoft does not own. The reverse-proxy structure of an AiTM kit such as Evilginx or Modlishka, which relays traffic to the real sign-in page and keeps the session cookie. A script that writes a command to the clipboard. None of these patterns depends on the domain's history, so a page built this morning and a page injected into a trusted site last night get the same scrutiny.

An attacker can generate 1,000 pages that each look unique. Every one still needs a credential form, a relay, or a script that does the damage, and those share structure and intent. Island can block a zero-hour page the moment it renders, with no dependence on a reputation lookup.

ClickFix protection

ClickFix tricks a user into copying a disguised shell command and pasting it into CMD, PowerShell, or Terminal. Island watches the clipboard, recognizes a command headed for the paste, and can warn or block before it runs. Admins choose how far the screening goes, and every detection is audited.

Attack surface reduction

Many attacks depend on specific browser capabilities, such as high-risk JavaScript components. Island restricts and audits their execution according to the risk of the destination. A potentially malicious site loses the capabilities an exploit needs, and trusted sites keep working.

Posture-aware decisions

Island evaluates device posture itself, and whether endpoint protection is running is one of the criteria. A medium-risk page gets a firmer response on an unhealthy device than on a healthy one.

Secure Website Viewer

Users and analysts can open a suspicious site in a remote browser without running it on the local device.

Isolation for the uncertain middle

Confidence routes the page. High-confidence benign pages load locally, and high-confidence malicious pages are blocked. Pages in between open in remote browser isolation (RBI), so isolation is spent only where it is needed.

A closed loop

Every verdict that matters becomes a new IOC and reaches every control point, so the system learns from its own detections. A verdict in the browser becomes an indicator on the desktop and at the network.

Island AI Investigators: Guardian Agents

After the verdict, Island AI Investigators keep working. They re-examine verdicts and sessions, find missed detections and false positives, and diagnose root causes. The security operations center (SOC) or the admin receives a diagnosed issue with a proposed fix, such as a policy change, a domain block, or a user notification. Issues appear in Island Insights, where admins can receive notifications by webhook or Slack and pull issues into their own tools through the application programming interface (API).

One defense for people and agents

AI agents now open pages, read content, and act for employees at a scale no workforce has matched. Each of those sessions is a new decision for the security team, and AI Threat Intelligence makes that decision for the agent the same way it does for the person. For the SOC, the work moves from hunting for context to approving a fix. Threat intelligence spent 20 years asking whether anyone had seen a threat before. The threats that matter now are the ones nobody has seen yet.

Ready to rethink threat intelligence in the agentic era?

If AI is changing your risk exposure faster than your threat feeds can keep up, we're happy to walk through Island's approach and the product behind it. Schedule a demo here.

‍