MITRE ATT&CK v20 Adds 9 New AI Exploits, MFA Bypass, CAPTCHA Evasion Techniques

Key Takeaways

• MITRE ATT&CK v20, released October 13, introduces nine new Enterprise techniques targeting AI systems, MFA bypasses, and CAPTCHA evasion.
• The update significantly expands coverage for Industrial Control Systems (ICS) and mobile devices, including new detection guidance.
• Five new techniques specifically address AI risks, such as prompt injection, data exfiltration via AI, and poisoning AI search results.
• The framework provides security teams with enhanced tools to map and detect emerging attacker behaviors across diverse IT, OT, and mobile environments.

MITRE ATT&CK v20: Addressing Evolving Cyber Threats

On October 13, MITRE unveiled ATT&CK v20, a substantial update to its globally recognized knowledge base of adversary tactics and techniques. This latest iteration introduces nine new Enterprise techniques that illuminate how attackers exploit artificial intelligence (AI) systems, circumvent multi-factor authentication (MFA) via application-specific passwords, and bypass CAPTCHA mechanisms. The update also extends its reach into industrial control systems (ICS) and mobile platforms, providing critical detection guidance for these newly documented behaviors.

For cybersecurity professionals, these enhancements offer a more granular lens through which to analyze and categorize malicious activities observed across corporate networks, AI deployments, mobile devices, and operational technology (OT) infrastructure. MITRE’s release notes detail these additions, while the detailed changelog itemizes the changes from version 19.2.

The ATT&CK framework serves as a common lexicon for defenders, enabling them to describe, compare, and strategize against adversary actions. A “technique” within this framework outlines a specific method an attacker might employ to achieve an objective, while a “detection strategy” links this behavior to actionable data that security teams can collect and analyze. Importantly, ATT&CK does not confirm breaches but rather furnishes a standardized language for threat intelligence, security assessments, and the development of robust detection capabilities.

Nine New Enterprise Techniques Highlight AI and Authentication Risks

A significant portion of the new Enterprise techniques in v20—five, to be exact—focus on the burgeoning threat landscape surrounding AI systems. These include:

• Direct Prompt Injection (T1699): Describes malicious instructions directly submitted to a large language model’s interface.
• Indirect Prompt Injection (T1698): Covers hostile instructions embedded within external content, such as web pages, emails, documents, or code, that an AI system subsequently processes.
• AI-Enabled Exfiltration (T1700): Details attempts to coerce an enterprise AI agent into transmitting sensitive data outside the organization’s perimeter.
• AI Result Poisoning (T1608.007): Focuses on manipulating public web content to influence AI search tools or assistants into returning, citing, or recommending attacker-controlled information.
• Impair Autonomous Defenses (T1685.007): Addresses efforts to disrupt AI-assisted security analysis, such as making automated tools ignore evidence or cease file reviews.

These new entries underscore the increasing integration of AI systems that interact with external content and perform actions via connected tools. This dynamic establishes a critical link between prompt security and traditional security controls, emphasizing that the data and actions accessible to an AI agent are as crucial as the model’s integrity itself.

Beyond AI, three additional techniques target CAPTCHA and anti-automation defenses. The new parent technique, Anti-Automation Evasion (T1696), encompasses two sub-techniques: Automate CAPTCHA Completion (T1696.001), which details the use of tools or services to solve challenges, and Avoid CAPTCHA (T1696.002), which describes methods to make automated activity appear human-like to circumvent triggering CAPTCHA challenges altogether.

The ninth new Enterprise technique, Steal Application Specific Passwords (T1697), addresses the vulnerability of passwords generated for legacy applications or devices that cannot support standard MFA. An attacker who compromises such a password can gain account access without triggering the usual second-factor authentication prompt. This technique highlights a distinct attack vector from direct MFA bypasses, leveraging separate credential paths that may lack robust MFA enforcement.

Expanded Coverage for ICS and Mobile Environments

Version 20’s enhancements extend beyond Enterprise IT. For Industrial Control Systems (ICS), MITRE has introduced a comprehensive Command and Scripting Interpreter (T1659) technique, complete with sub-techniques for PowerShell, Windows Command Shell, Unix Shell, Visual Basic, Python, and JavaScript. This replaces older entries, allowing for more precise identification of the specific interpreter used in an attack.

New ICS sub-techniques also cover the misuse of DNS and publish/subscribe protocols for command and control. This granularity is vital in industrial settings, where distinguishing legitimate engineering and control activities from malicious behavior is paramount. MITRE has also enriched ICS detection strategies with platform and asset context, helping defenders determine if a detection applies to a Windows workstation, network device, or embedded system.

The update includes 15 new detection strategies and 38 analytics across the entire release. In ICS, these analytics are specifically designed to filter out routine engineering and maintenance activities, thereby reducing false positives and focusing alerts on genuinely suspicious events.

For mobile platforms, v20 reinstates the Deliver Malicious Application via Other Means (T1404) technique, last seen in ATT&CK v11. This updated entry details various non-official channels for delivering malicious applications to devices, including direct downloads, text messages, messaging apps, QR codes, and third-party app stores. MITRE also added NGate, a malware strain known for relaying payment card data through a phone’s tap-to-pay chip, and revised 28 existing mobile software entries.

Strategic Value for Defenders

The true value of ATT&CK v20 lies not merely in the volume of new entries but in its ability to integrate emerging AI risks and familiar access methods into a unified framework. This allows defenders to systematically track malware, credentials, and activities across diverse IT, OT, and mobile networks. Security teams can now specifically evaluate their monitoring capabilities for AI prompts and agent actions, assess the necessity and security of application-specific passwords, and test their services’ resilience against automated CAPTCHA evasion attempts.

While the update provides a more detailed foundation for detection, it is crucial to remember that a framework entry is not a pre-configured alert rule. Organizations must still verify the availability of relevant logs and telemetry, fine-tune detections to their unique systems, and confirm that flagged activities are indeed anomalous for their specific environment. When utilized effectively, MITRE ATT&CK v20 empowers security teams to translate novel threat patterns into practical questions for enhancing monitoring, access control, and incident response strategies.

What You Should Do

• Review AI System Security: Assess all AI agents and models for vulnerabilities related to direct and indirect prompt injection. Implement robust input validation and sanitization for all user and external content interacting with AI.
• Limit AI Agent Permissions: Restrict the tools and data access available to enterprise AI agents to the absolute minimum required for their legitimate functions. Monitor their actions and data interactions closely.
• Audit Application-Specific Passwords: Conduct a comprehensive audit of all application-specific passwords in use. Identify if they are still necessary and enforce strict policies for their creation, management, and revocation, especially where they bypass standard MFA.
• Strengthen Anti-Automation Defenses: Evaluate the effectiveness of CAPTCHA and other anti-automation mechanisms. Consider advanced bot detection solutions that analyze behavioral patterns rather than relying solely on static challenges.
• Update ICS Security Strategies: Incorporate the new ICS techniques and detection strategies into your operational technology security monitoring. Pay close attention to command and scripting interpreter usage, as well as DNS and publish/subscribe protocols for command and control.
• Enhance Mobile Device Security: Educate users about the risks of sideloading applications from unofficial sources. Implement mobile device management (MDM) solutions to control app installations and regularly review the security posture of mobile endpoints.
• Map Existing Controls to ATT&CK v20: Use the updated framework to map your current security controls and detection capabilities against the new and revised techniques, identifying any gaps in coverage.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.