Huntress Report Exposes Top Cyber Threats Targeting Businesses

In Q1 2026, 45% of endpoint-related incidents Huntress investigated involved abuse of remote monitoring and management (RMM) tools — a striking concentration of harm inside software administrators already trust.

RMM abuse: persistent access that looks like ordinary admin work

Huntress places RMM abuse in the top-right of its Tragic Quadrant — the “OH $#!T” corner of tactics that hide inside everyday workflows. The report explains why: a single rogue RMM install can give attackers persistent, legitimate-looking access that blends with routine administrative activity. Huntress also notes attackers are increasingly using AI to craft convincing fake document shares and service agreement lures that trick users into installing unwanted RMMs.

Mailbox manipulation: an invisible path into business email compromise

Mailboxes are a strategic target. Huntress reports that 24.6% of Identity Threat Detection and Response (ITDR) signals so far in 2026 point to mailbox manipulation and persistence. With mailbox access, attackers can change inbox rules and send vendor replies to folders that receive less scrutiny — for example, RSS Feeds or Archive — then tweak invoice details and redirect payments without deploying malware that detection tools would flag.

Adversary-in-the-middle (AiTM): sidestepping MFA with stolen sessions

The Tragic Quadrant highlights AiTM attacks as a significant identity threat and cites Huntress data that adversary-in-the-middle incidents made up 18.9% of all identity-based threats the company tracked in 2025. In these attacks, an intruder positions between the user and the genuine Microsoft 365 login page to steal a session token in transit and forward traffic so the user sees nothing unusual. Huntress emphasizes that as long as the session is valid, attackers can access accounts without a new password or MFA prompt.

Device code phishing, ClickFix, and AI platform abuse: fast-moving, divergent risks

• Device code phishing: Huntress calls this technique “low-key deadly” because it leverages Microsoft’s real device code login flow; checking the URL is insufficient. The report documents an incident in which a phishing-as-a-service kit named EvilTokens reached 344 organizations across five countries in a 16-day window.
• ClickFix: A social-engineering pattern that exploits copy-paste habits. A fake CAPTCHA or “verification failed” prompt can elicit a pasted command into a terminal that immediately executes, delivering infostealer malware or ransomware. Huntress reports ClickFix accounted for roughly 2.2% of managed EDR detection signals in 2026 so far, and nearly 99% of those detections were high severity.
• AI platform abuse: Placed in the Tragic Quadrant’s “overhyped” corner for now, this pattern is nonetheless emerging. Attackers hide malicious content behind real AI tools and workflows hosted on trusted domains. Huntress documents FakeAgent using a malicious Claude Artifact on the real claude.ai domain to direct people seeking “Claude Desktop” to SectopRAT, reaching 29 organizations in two days.

What this means for technologists, procurement leaders, and end users

• Technologists and security teams: Prioritize visibility into approved remote tools, mailbox rule changes, and session/token telemetry — Huntress directs readers to start in the Tragic Quadrant’s top-right corner. Detection should focus on anomalous RMM installs, unexpected inbox rule modifications, and odd session behavior consistent with AiTM attacks.
• Procurement and IT purchasing: Evaluate remote access tools and vendor-supplied workflows for misuse potential. Huntress’ examples — RMMs, device code flows, and shared AI artifacts — underline the need to control which remote tools are approved and how they are distributed to staff.
• End users: Be skeptical of unexpected device code prompts, unsolicited “productivity helper” artifacts hosted on familiar AI domains, and copy-paste prompts that ask you to run commands. Huntress’ incidents show social engineering remains the simplest effective vector.

Huntress positions the Tragic Quadrant as a practical triage: start with the top-right threats and work outward. The firm pairs its data points with a ransomware simulator “built from tactics Huntress has seen used against real businesses,” and urges organizations to ask whether remote tools are approved and whether mailbox and session anomalies would be caught before they cascade into fraud or encryption events.

The pattern running through Huntress’ findings is clear: attackers increasingly exploit trusted tools and workflows — RMMs, mailbox rules, legitimate login flows, paste-to-terminal habits, and even credible AI artifacts — because those paths look normal until they aren’t. For defenders, the immediate task is not to chase the flashiest headlines but to make the everyday harder for an attacker to abuse.

Source: The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest — BleepingComputer