Identity Theft Dominates 4 Key Threat Patterns

"Identity was the target in roughly half of all confirmed malicious activity this quarter."

Prophet Security reached that conclusion after investigating every alert across customer environments from May 1 to July 31, 2026 — some 4.7 million automated questions, with a median of 35 questions per investigation. Of completed investigations, about 93% were benign and 7% were confirmed malicious; the following account is drawn from that 7 percent.

Session hijacking and session-replay were the most effective routes into accounts

Direct attacks on accounts and sessions — session hijacking, token replay, MFA bypass, credential stuffing, and post-compromise persistence such as inbox rules and OAuth consent grants — accounted for roughly 18% of confirmed malicious activity. Prophet’s data shows a clear dividing line: attempts using passwords were usually blocked, while attacks using already-authenticated sessions repeatedly succeeded.

The reason is procedural: conditional access and MFA checks trigger during authentication, but a replayed session cookie skips authentication entirely. A stolen refresh token only returns to the identity provider when redeemed, meaning that re-evaluation and revocation only occur at that moment. As Prophet observed, disabling an account did not always stop attackers because access granted prior to the disablement continued to work in some organizations. In one case, attackers even changed authentication methods and granted OAuth consents while responders believed the incident was closed.

The report documents real-time relay infrastructure as well: a login from one country followed by an MFA approval from another country just sixteen seconds later, and again after 118 seconds on a second attempt — timing that signals an active proxy relaying credentials and approvals. MFA fatigue and push-bombing also succeeded where systems permitted repeated prompts or where automatic unlock policies were exploitable.

Browser-delivered infostealers — ClearFake, SocGholish and the cookie problem

Malicious code execution and tooling represented about 23% of confirmed malicious activity, and infostealer activity affected roughly a quarter of organizations. Critically, these infostealers were most often delivered through web browsers rather than traditional email attachments: compromised legitimate websites, malicious ads, sponsored search results, fake CAPTCHA gates (ClickFix), and fake update prompts hosted on compromised sites were repeatedly observed.

Trojanized installers were the most common initial foothold, appearing at about a quarter of organizations. Prophet identified delivery tooling such as ClearFake and SocGholish (the latter’s infrastructure was disrupted on June 18, 2026 under Operation Endgame during the reporting period) and payloads including Lumma Stealer, Vidar, HijackLoader, and AsyncRAT.

Attackers frequently decrypted browser cookie stores and extracted Microsoft authentication cookies to make authenticated API requests. Because a stolen cookie requires no password or MFA, it survives a password reset and can persist through device wipes unless the session is explicitly revoked. Prophet sums it up plainly: an endpoint compromise can quickly become an identity compromise via the browser.

Highly targeted phishing campaigns and mailbox-rule persistence

Credential phishing was the single largest category, comprising about 28% of confirmed malicious activity. These campaigns were narrowly focused, repeatedly targeting financial roles — finance executives, collections, accounts payable, treasury mailboxes — and company leaders with ACH-themed lures. In one instance, attackers repeatedly targeted an automated invoice-processing mailbox that had no human user to spot anomalies.

Phishing messages often arrived through trusted infrastructure: legitimate collaboration platforms, major cloud email services, consumer file-sharing links, and even impersonations of internal systems. Attackers used Unicode characters in subjects to evade filters, newly registered and typosquatted domains, and tracking pixels to confirm opens. Standard email authentication failures did not always stop delivery; Prophet cites a spoofed message that failed SPF, DKIM, and DMARC but still reached over a dozen inboxes.

When attackers gained access, modifying inbox rules was a common persistence technique — nearly as frequent as impossible-travel alerts. Rules that delete or hide incoming messages keep victims unaware and survive password resets, making them a favored method for maintaining stealth.

Unmonitored assets, EDR gaps, and the longest intrusions

Pre-ransomware and manual attacker activity made up about 9% of confirmed malicious activity. EDR supplied the broadest telemetry for these cases, but many of the longest intrusions ran from devices with no endpoint agent installed. Prophet describes a multi-week credential attack on a production identity server without endpoint coverage and a six-week lateral movement campaign starting from an unmanaged, unmonitored host. Several campaigns were only detected because other network telemetry revealed activity from otherwise unmonitored attacker machines.

Attackers often used legitimate Windows tools to access LSASS, created shadow copies to read credential data from the registry, or leveraged remote registry services with impersonation tokens. Pre-ransomware behaviors — destroying shadow copies, dumping credentials, deploying remote access tools — were much more common than actual ransomware deployment during the quarter. About 15% of organizations had attackers using commercial remote access tools, which tend to evade malware controls and survive password resets.

What this means for technologists, procurement leaders, and end users

• Technologists and security teams: prioritize detection and revocation of active sessions and instrument authentication logs against endpoint coverage. Prophet’s findings show password resets alone are often insufficient when cookies, inbox rules, or remote-support tools remain active.
• Procurement and asset managers: verify endpoint agent coverage on identity-critical servers and monitor for unmonitored devices authenticating to the network; gaps correlated with some of the quarter’s longest-running campaigns.
• End users and business leaders: targeted phishing — especially against finance roles and automated mailboxes — persisted because attackers used trusted delivery channels and replayed sessions. Automated email remediation and rapid removal materially reduced time-to-removal in some organizations.

Prophet Security’s quarterly dataset underlines a simple, uncomfortable truth: attackers are not inventing new techniques so much as shifting the pivot point where existing controls stop working. In this quarter that pivot was often the session cookie, the browser, or an unmonitored host — things that let access survive a password reset. The remedy, the investigators found, began with asking basic questions and following the evidence until it led to the session, the rule, or the unmonitored box.

Read the original report at https://www.bleepingcomputer.com/news/security/the-top-4-threats-we-found-by-investigating-every-alert-for-a-quarter/.