MITRE ATT&CK v20 Added 9 New Attack Techniques Covering AI Exploits, MFA Bypass, and CAPTCHA Evasion

MITRE released ATT&CK v20 on October 13, adding nine Enterprise techniques that describe how attackers may target AI systems, steal application-specific passwords to bypass multi-factor authentication (MFA), and get around CAPTCHA checks. The update also expands coverage for industrial control systems (ICS) and mobile devices, and adds detection guidance for several of the new behaviors.

For security teams, the changes offer a clearer way to map activity they already see across business networks, AI tools, phones, and industrial systems. MITRE’s release notes list the additions, and its detailed changelog records what changed from v19.2.

ATT&CK is a knowledge base that helps defenders describe and compare attacker behavior. A technique is a way an attacker may try to achieve a goal, while a detection strategy connects that behavior to data defenders can collect and review.

The framework does not confirm that a specific organization has been breached. Instead, it gives teams a shared language for threat reports, security testing, and detection planning.

MITRE ATT&CK v20 – Nine New Enterprise Techniques

Five of the new Enterprise techniques address the risks around AI systems. Direct Prompt Injection covers malicious instructions entered straight into a large language model’s interface. Indirect Prompt Injection describes instructions hidden in content an AI system reads, such as a web page, email, document, or code file.

If an AI agent can use tools or access business data, hostile content could try to steer its actions beyond what the user intended. The techniques help teams distinguish between a user submitting a malicious prompt and an AI system encountering one in outside content.

AI-Enabled Exfiltration describes attempts to get an enterprise AI agent to send data out of an organization. AI Result Poisoning covers a different route: manipulating public web content so AI search tools or assistants may return, cite, or recommend attacker-controlled information.

The fifth AI-related entry, Impair Autonomous Defenses, covers efforts to disrupt AI-assisted security analysis. For example, hostile content could try to make an automated tool ignore evidence or stop reviewing a file.

These entries reflect the growing use of AI systems that read outside content and can take actions through connected tools. That creates a link between prompt security and familiar security controls: the data and actions an AI agent can reach matter as much as the model itself.

Cyber Security News has covered prompt injection risks for AI agents and a reported case where a prompt could expose AWS AI agent data. Those reports describe separate incidents and research, but they illustrate why teams should limit agent permissions and monitor tool use.

Three more techniques address CAPTCHA and other anti-automation checks. ATT&CK now has a parent technique, Anti-Automation Evasion, with two sub-techniques: Automate CAPTCHA Completion and Avoid CAPTCHA.

The first covers tools or services that solve challenges. The second covers attempts to make automated activity look more like normal human browsing. CAPTCHA may slow down bots, but it is not a complete barrier when attackers can automate or outsource the challenge.

The ninth new Enterprise technique, Steal Application-Specific Passwords, concerns passwords created for older apps or devices that cannot use standard MFA. An attacker who obtains one may access an account without completing the usual second-factor check.

This is not the same as breaking MFA itself. Rather, it uses a separate credential path that may not prompt for the normal MFA step. Cyber Security News previously reported on Google app passwords being used to bypass MFA, showing why organizations should review where these passwords are allowed and who can create them.

The v20 changes extend beyond Enterprise. In ICS, MITRE added a Command and Scripting Interpreter technique and sub-techniques for PowerShell, Windows Command Shell, Unix Shell, Visual Basic, Python, and JavaScript.

These replace two older entries, making it possible to record the specific interpreter used. New sub-techniques also cover DNS and publish/subscribe protocols used for command and control. This matters in industrial environments, where defenders need to separate unusual activity from normal control and engineering work.

MITRE also added ICS detection strategies with platform and asset context, so teams can see whether a detection applies to a Windows workstation, network device, or embedded system.

The release notes say the update includes 15 new detection strategies and 38 analytics across the release. In ICS, analytics are designed to filter routine engineering and maintenance activity, helping reduce alerts that do not point to suspicious behavior.

For mobile, v20 restores the technique Deliver Malicious Application via Other Means, which was last present in ATT&CK v11. The updated entry covers ways malicious apps can reach devices outside official stores, including direct downloads, text messages, messaging apps, QR codes, and third-party stores.

MITRE also added NGate, malware described as relaying payment card data through a phone’s tap-to-pay chip, and revised 28 existing mobile software entries.

The main value of v20 is not simply the number of new entries. It connects emerging AI risks and familiar access methods to the same framework defenders use to track malware, credentials, and activity in industrial networks. Teams can review whether their monitoring covers AI prompts and agent actions, check if application-specific passwords are still needed, and test how their services respond to automated CAPTCHA attempts.

The update also gives defenders a more detailed starting point for detection, but a framework entry is not a ready-made alert rule. Teams still need to check which logs and telemetry they have, tune detections to their own systems, and confirm that the activity being flagged is unusual for their environment.

Used that way, MITRE ATT&CK v20 can help security teams turn new threat patterns into practical questions for monitoring, access control, and incident response.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post MITRE ATT&CK v20 Added 9 New Attack Techniques Covering AI Exploits, MFA Bypass, and CAPTCHA Evasion appeared first on Cyber Security News.