Phishing Campaign Targets 99% of US Military Bases During Heightened US-Iran Tensions
The Media Trust's threat data shows a surge in AI-personalized phishing aimed at service members and their families.
As geopolitical conflict extends into cyberspace, military personnel and their families have become targets on a new digital front. Increasingly, that front begins not at the installation gate, but on the smartphones, laptops, tablets, and connected devices used every day by the people who serve.
The Department of War invests heavily in protecting military networks, endpoints, and classified systems from intrusion. Those investments remain essential. The challenge is that the attack surface has fundamentally changed.
Today’s adversaries no longer focus solely on penetrating hardened government networks. They are increasingly seeking access through the digital lives of military personnel and their families, using trusted digital experiences as the pathway.
At The Media Trust, our Malware Desk continuously monitors malicious activity across the digital ecosystem, including threats delivered through the open web, social media, and apps. Over the past year, our telemetry has revealed a pattern that should command the attention of defense leaders and policymakers.
Between July 2025 and July 2026, we observed a dramatic increase in AI-enabled phishing campaigns targeting 277 domestic military bases, representing approximately 99 percent of all US military installations, along with military personnel and families living on base.
Monthly attack volume climbed from hundreds of thousands of events to more than 4.3 million attacks in July 2026, the highest level recorded during the monitoring period.
What makes these findings particularly significant is not simply the scale and tempo of the attacks, but the consistency with which they intensified during periods of heightened military tension between the United States and Iran.
Whether missiles are flying or diplomacy is underway, America’s military community has become a frontline target in cyberspace. This is no longer simply a cybersecurity concern. It is a national security issue.
Digital Attacks Increasingly Follow Geopolitical Conflict
Our data revealed a steady increase in malicious activity throughout late 2025 before accelerating sharply after hostilities intensified in the Middle East.
The first major surge occurred on May 19, the day Operation Epic Fury concluded. At that point, it represented the highest daily volume of attacks observed against military communities during the monitoring period.
That record was surpassed just two months later.
The largest daily attack volumes occurred on July 28 and July 29, coinciding with reports that the United States intercepted a surprise Iranian missile attack. The operational lesson is clear: the volume and intensity of digital attacks directed at military communities can increase rapidly during periods of geopolitical conflict.
Military planners have long anticipated that future conflicts would include cyber operations. The data suggests those operations are already unfolding, not only against military networks, but against the people who support the mission every day.
AI Transforms Digital Media Into a Weapon
One of the most significant lessons from this campaign is not who was targeted. It is how they were targeted.
When cybersecurity professionals hear the word phishing, they still think of fraudulent email. This is an antiquated notion that no longer reflects how sophisticated campaigns are reaching military communities.
The attacks observed by The Media Trust were delivered through AI-enabled targeted digital content distributed across the open web, social media, and mobile apps. Service members and their families encountered malicious content while consuming ordinary digital media, including deceptive advertisements, browser redirects, and convincing fake tech support experiences that appeared during routine online activity.
AI is fundamentally changing how these campaigns operate.
Rather than presenting every victim with the same fraudulent message, AI enables attackers to customize malicious content in real time based on the characteristics of the device receiving it. Operating systems, browser configurations, installed security software, and other technical signals allow attacks to adapt before they are displayed.
The result is an experience that appears authentic because it reflects the victim’s own computing environment. AI allows attackers to personalize digital attacks at enormous scale, making them substantially more convincing than traditional phishing campaigns.
Military personnel do not see the same attack as everyone else. Their devices receive content tailored to the technology they use. The same is true for military families. AI has transformed mass phishing into individualized digital targeting.
Targeting People Instead of Networks
The scale of this campaign is remarkable. Our Malware Desk observed activity targeting 277 domestic military installations, representing nearly every military base in the United States.
The campaign extended beyond military infrastructure to include active duty service members, civilian employees, veterans, and military families living on base. Every smartphone used by a spouse, every laptop used by a teenager completing homework, every tablet connected to home Wi-Fi, and every mobile app or browser session initiated from military housing represents another opportunity for attackers to gain access to the broader military community.
Military families are not incidental victims. They are part of the attack surface. Adversaries recognize that compromising people is often easier than compromising military networks. If they cannot reach the mission directly, they target the people connected to it.
GhostCat Demonstrates How AI Makes Cyber Campaigns More Effective
The campaign observed across military communities leveraged the GhostCat malware vector, a persistent threat that has remained active by continuously evolving its tactics.
Each new iteration becomes more convincing, more personalized, and more difficult to distinguish from legitimate digital experiences. Rather than relying on malicious email attachments or traditional malware downloads, GhostCat exploits targeted digital media, trusted websites, advertising infrastructure, and browser-based social engineering.
The overwhelming majority of attacks observed during this campaign appeared as technical support scams – as seen below.
These were not static copies of legitimate antivirus software. The malicious content dynamically adapted to the victim’s device. By evaluating information naturally exposed by the browser and operating system, the attack generated security warnings that reflected the victim’s computing environment, including the operating system and security software already installed on the device.
For the user, the alert appears legitimate because it matches the technology they already trust.
AI makes this level of personalization possible at enormous scale. Instead of one fraudulent message reaching thousands of users, thousands of customized attacks are generated automatically for individual victims.
The objective is straightforward. Convince the victim that the warning is real, persuade them to install remote access software or provide credentials, and gain control of a trusted device.
Why It Is a National Security Issue
The phishing campaign is not the objective. It is the opening move. The goal is access.
If attackers successfully compromise a military family member, they gain opportunities for financial fraud, identity theft, or extortion.
If they compromise a service member or civilian employee connected to a military installation, the potential value is far greater. Compromised devices can expose credentials, authentication tokens, communications, travel patterns, operational routines, personal relationships, and other information that can support intelligence collection or future cyber operations.
This is why campaigns like these should not be viewed as ordinary cybercrime. They represent a modern pathway into America’s military ecosystem.
For years, national security discussions have focused on protecting military networks. Increasingly, the more accessible target is the trusted device carried by the people who use those networks every day.
Military Readiness Must Include Digital Readiness
Military readiness has traditionally focused on protecting personnel, infrastructure, equipment, and operational capability. Digital resilience must now become part of that mission.
The recent GhostCat campaign demonstrated that attackers no longer need to penetrate secure facilities to create operational risk. They only need to compromise the trusted devices that move between military installations, military housing, and everyday life.
This campaign reached nearly every domestic military base. It targeted military personnel and their families not through sophisticated intrusions into classified networks, but through the digital content they consumed every day.
That should concern every leader responsible for America’s defense posture.
Future conflicts will not be fought solely with missiles, aircraft, ships, or cyber operations directed against government systems. They will also be fought through AI-enabled digital media that identifies, targets, and persuades individuals with increasing precision.
Protecting America’s military advantage therefore requires expanding how we define the perimeter. It no longer ends at the installation gate or the edge of a secure network. It extends to every connected device carried by the people who serve and the families who support them.
America has spent decades hardening its military infrastructure against physical attack. The next challenge is recognizing that AI has transformed targeted digital media into a weapon and that trusted devices have become pathways into military communities.
Protecting military readiness now requires protecting the people who carry that battlefield in their pockets.
Chris Olson is the CEO of The Media Trust, where he has spent more than two decades protecting brands, publishers, and consumers from digital threats across advertising, content, and data ecosystems.
He is also the founder of Proxyware, a proactive digital protection platform designed to safeguard vulnerable populations by stopping harmful online threats before they reach the end users.
Olson is widely recognized for his expertise in digital risk, consumer safety, and the evolving tactics of online fraud and exploitation, with a focus on prevention over reaction.