Huntress Ranks Tactics Putting Businesses at Risk
Summary
Huntress’s Tragic Quadrant ranks tactics targeting businesses, including RMM abuse, mailbox manipulation and AiTM. Huntress reports RMM abuse in 45% of its Q1 2026 endpoint investigations and explains device-code phishing, ClickFix and AI-platform lures.
Key points
- Huntress reports that RMM abuse appeared in 45% of its Q1 2026 endpoint-related incident investigations; rogue installs can provide persistent access.
- The article says 24.6% of Huntress ITDR signals so far in 2026 involved mailbox manipulation and persistence, which can divert vendor replies and redirect invoice payments.
- AiTM attacks made up 18.9% of identity-based threats Huntress tracked in 2025; stolen session tokens can allow account access without a password or fresh MFA prompt.
- Huntress says the EvilTokens phishing-as-a-service kit targeted 344 organizations across five countries in a 16-day period using device-code phishing.
- ClickFix prompts trick users into pasting malicious commands; the article says it accounted for about 2.2% of Huntress Managed EDR detection signals so far in 2026, nearly 99% of them high severity.
- Huntress describes FakeAgent using a malicious Claude Artifact on claude[.]ai to direct users seeking Claude Desktop to SectopRAT; it reportedly reached 29 organizations in two days.
- The article recommends reviewing approved remote tools and watching for mailbox-rule changes, unusual device-code prompts and anomalous session or token activity.
Article Details
- Topic
- Ranking of prevalent cybersecurity tactics affecting businesses, including RMM abuse, mailbox manipulation, account takeover, device code phishing, ClickFix, and abuse of AI platforms.
MITRE ATT&CK
T1114.003 · Email Forwarding RuleAttackers manipulate mailbox rules to divert vendor replies into less-monitored folders.T1204.004 · Malicious Copy and PasteClickFix prompts users to paste a malicious command, which triggers code execution.T1219 · Remote Access ToolsAttackers abuse remote monitoring and management software by installing rogue RMM tools for persistent access.T1528 · Steal Application Access TokenDevice code phishing obtains an access token after the victim enters a code into the legitimate device-code login flow.T1557 · Adversary-in-the-MiddleIn adversary-in-the-middle attacks, attackers intercept authentication traffic and steal session tokens.
Malware
Vendors
Products
ChatGPTA fake “desktop client” or “productivity helper” might live inside a shared conversation or a hosted artifact on a trusted AI domain like Claude or ChatGPT, which makes it tricky to tell what’s malicious.ClaudeA fake “desktop client” or “productivity helper” might live inside a shared conversation or a hosted artifact on a trusted AI domain like Claude or ChatGPT, which makes it tricky to tell what’s malicious.Microsoft 365 Apps for EnterpriseEach of these tactics hides inside something your team uses every day, like a remote access tool or a Microsoft 365 login.