InfoSecBulletin Cybersecurity for mankind
MITRE released ATT&CK v20 adding nine Enterprise techniques that explain how attackers might target AI systems, steal app-specific passwords to bypass multi-factor authentication (MFA), and avoid CAPTCHA checks. The update also covers industrial control systems (ICS) and mobile devices better, and it includes detection tips for some of the new actions.
The changes help security teams see activities better across business networks, AI tools, phones, and industrial systems. MITRE’s release notes show the new features, and the changelog shows what was different from v19.2.
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
MITRE ATT&CK v20 – Nine New Enterprise Techniques
Five new Enterprise methods focus on the dangers of AI systems. Direct Prompt Injection deals with harmful commands put directly into a large language model’s interface. Indirect Prompt Injection refers to commands concealed in the content an AI system accesses, like a web page, email, document, or code file.
If an AI can use tools or access business data, bad content could influence its actions in ways the user did not want. These methods help teams tell the difference between a user sending a harmful request and an AI system facing one in outside content.
AI-Enabled Exfiltration means trying to make an AI agent send data outside a company. AI Result Poisoning is about changing web content so that AI tools might show or suggest information controlled by attackers.
The fifth AI-related entry, Impair Autonomous Defenses, talks about stopping AI security checks. For instance, bad content might make an automated tool overlook proof or stop looking at a file.
These entries show more people are using AI systems that read content from outside sources and can perform actions with connected tools. This connects prompt security to familiar security controls: the data and actions an AI agent can access are just as important as the model itself.
| ATT&CK ID | Technique / Sub-Technique | Type | Description |
|---|---|---|---|
| T1697 | Steal Application Specific Passwords | Technique | Attackers phish, generate, or steal application-specific passwords to access accounts without completing the usual MFA checks. |
| T1696 | Anti-Automation Evasion | Technique | Attackers bypass checks designed to block bots, allowing automated activity to continue. |
| T1696.001 | Automate CAPTCHA Completion | Sub-technique | Attackers use automated tools or CAPTCHA-solving services to complete challenges intended to verify human users. |
| T1696.002 | Avoid CAPTCHA | Sub-technique | Attackers avoid triggering CAPTCHA challenges rather than solving them after they appear. |
| T1699 | Direct Prompt Injection | Technique | Attackers submit malicious instructions directly to an AI system’s interface to influence its behavior. |
| T1698 | Indirect Prompt Injection | Technique | Attackers place malicious instructions in outside content that an AI system processes, such as documents or web pages. |
| T1700 | AI-Enabled Exfiltration | Technique | Attackers direct enterprise AI agents to send sensitive information outside the organization. |
| T1608.007 | Stage Capabilities: AI Result Poisoning | Sub-technique | Attackers manipulate web content to influence the information, links, or recommendations returned by AI search tools and assistants. |
| T1685.007 | Disable or Modify Tools: Impair Autonomous Defenses | Sub-technique | Attackers interfere with AI-assisted security tools to disrupt their analysis of malware or suspicious activity. |
Three more methods deal with CAPTCHA and other checks against automation. ATT&CK now includes a main method called Anti-Automation Evasion, which has two sub-methods: Automate CAPTCHA Completion and Avoid CAPTCHA.
The first talks about tools or services that fix problems. The second talks about ways to make automatic tasks seem more like real human browsing. CAPTCHA can slow bots down, but it doesn’t stop them completely since attackers can automate or get help with the challenge.
The ninth new Enterprise technique, Steal Application-Specific Passwords, is about passwords made for older apps or devices that can’t use standard MFA. An attacker who gets one can access an account without the usual second check.
The v20 changes go beyond Enterprise. In ICS, MITRE added a Command and Scripting Interpreter method and methods for PowerShell, Windows Command Shell, Unix Shell, Visual Basic, Python, and JavaScript.
These take the place of two old entries, allowing the recording of the specific interpreter used. New sub-techniques now include DNS and publish/subscribe protocols for command and control. This is important in industrial settings, where defenders must identify unusual actions from regular control and engineering tasks.
MITRE also added ways to detect ICS with information about the platform and assets. This helps teams know if a detection applies to a Windows computer, network device, or embedded system.
The release notes say the update has 15 new ways to detect issues and 38 analytics. In ICS, these analytics help sort out normal engineering and maintenance work. This helps cut down alerts that do not show any suspicious behavior.
| No. | Domain | Detection Strategy | Detection Focus |
|---|---|---|---|
| 1 | Enterprise | Detect AI-Enabled Exfiltration | Identifying attempts to use enterprise AI agents to send sensitive data outside the organization. |
| 2 | Enterprise | Detection of AI Result Poisoning | Identifying manipulation of web content intended to influence AI-generated answers, citations, or recommendations. |
| 3 | Enterprise | Detection of Anti-Automation Evasion | Detecting attempts to bypass checks designed to distinguish human users from bots. |
| 4 | Enterprise | Detection of Automated CAPTCHA | Detecting automated completion of CAPTCHA challenges. |
| 5 | Enterprise | Detection of Avoid CAPTCHA | Detecting activity designed to avoid triggering CAPTCHA challenges. |
| 6 | Enterprise | Suspicious Acquisition and Use of Application-Specific Passwords | Identifying suspicious creation, acquisition, or use of application-specific passwords that can bypass normal MFA checks. |
| 7 | ICS | Behavioral Detection of Command and Scripting Abuse in ICS | Detecting suspicious use of command interpreters and scripting tools in industrial environments. |
| 8 | ICS | Behavioral Detection of DNS Protocol Misuse for Command and Control | Identifying misuse of DNS communications for attacker command and control. |
| 9 | ICS | Behavioral Detection of JavaScript Execution in ICS | Detecting suspicious JavaScript execution on industrial systems. |
| 10 | ICS | Behavioral Detection of PowerShell Execution in ICS | Detecting suspicious PowerShell execution on industrial systems. |
| 11 | ICS | Behavioral Detection of Publish/Subscribe Protocol Misuse for Command and Control | Identifying misuse of publish/subscribe messaging protocols for attacker communications. |
| 12 | ICS | Behavioral Detection of Python Execution in ICS | Detecting suspicious Python execution within industrial environments. |
| 13 | ICS | Behavioral Detection of Unix Shell Execution in ICS | Detecting suspicious Unix shell commands or scripts on industrial systems. |
| 14 | ICS | Behavioral Detection of Visual Basic Execution in ICS | Detecting suspicious Visual Basic execution within industrial environments. |
| 15 | ICS | Behavioral Detection of Windows Command Shell Execution in ICS | Detecting suspicious Windows command shell execution |
For mobile, v20 brings back the method Deliver Malicious Application via Other Means, which was in ATT&CK v11. The new entry shows how bad apps can get to devices outside official stores, like direct downloads, texts, messaging apps, QR codes, and third-party stores.
MITRE also added NGate, a malware that sends payment card data using a phone’s tap-to-pay chip, and updated 28 current mobile software entries.
The main value of v20 is not just the number of new entries. It links new AI risks and common access methods to the same system that defenders use to watch malware, credentials, and activity in industrial networks. Teams can see if their monitoring looks at AI prompts and actions, check if special passwords are still necessary, and test how their services deal with automatic CAPTCHA tries.
The update helps defenders by giving them more details about detection, but it is not an alert rule that is already made. Teams still have to look at their logs and telemetry, adjust detections for their own systems, and make sure that the flagged activity is unusual for them.
Using MITRE ATT&CK v20 like this can help security teams change new threat patterns into useful questions for monitoring, access control, and responding to incidents.
Related news:
MITRE Unveils Top 25 Most Dangerous Software Weaknesses of 2025
