Cisco Talos: Phishing Led Initial Access in Q1 2026 as Attackers Used AI Web Builder
Summary
Cisco Talos says phishing led Q1 2026 initial access in over a third of assessable engagements. Its report details Softr-built credential theft, a Crimson Collective Azure intrusion, declining ToolShell exploitation, and persistent MFA and logging gaps.
Key points
- Phishing accounted for over one-third of Q1 2026 engagements where initial access could be determined, returning to the top method.
- Attackers used Softr's no-code tools to build a credential-harvesting page mimicking Microsoft Exchange and Outlook Web Access; Talos called this its first documented use of a specific AI tool in a confirmed phishing engagement.
- Public administration and healthcare each represented 24% of engagements, tying as the most targeted sectors.
- An exposed GitHub Personal Access Token enabled access to Azure data; the attacker used TruffleHog and Microsoft Graph. Talos attributed the activity to Crimson Collective based on IP and tactics overlap.
- ToolShell-related public-facing application exploitation fell from a 62% peak to 18% of engagements; Talos attributed the decline to emergency patches and improved detection.
- MFA weaknesses appeared in 35% of engagements, exposed or vulnerable infrastructure in 25%, and insufficient logging in 18%.
- Pre-ransomware activity accounted for 18% of engagements; early containment prevented encryption, and Talos assessed with moderate confidence that Rhysida and MoneyMessage were involved in two engagements.
Article Details
- Publisher
- Help Net Security
- Report Period
- Q1 2026
- Scope
- Cisco Talos engagements, including initial access methods, targeted sectors, and security gaps.
- Key Statistics
- Phishing accounted for over one-third of engagements where initial access could be determined in Q1 2026.
- Public administration and healthcare each accounted for 24% of engagements, tying as the most targeted sectors.
- MFA weaknesses appeared in 35% of engagements.
- Vulnerable or exposed infrastructure appeared in 25% of engagements.
- Insufficient logging and pre-ransomware activity each affected 18% of engagements.
- Recommendations
- Deploy a SIEM for centralized log storage so logs deleted or modified on individual hosts remain available for forensic review.
CVE
CVE-2023-20198Cisco · Cisco IOS XE SoftwareMFA weaknesses (35%), exposed infrastructure including CVE-2025-20393 and CVE-2023-20198 (25%), insufficient logging (18%), and pre-ransomware activity involving Rhysida and MoneyMessage were key security gaps.CVE-2025-20393Cisco · Cisco Secure Email; Cisco · Cisco Secure Email and Web ManagerMFA weaknesses (35%), exposed infrastructure including CVE-2025-20393 and CVE-2023-20198 (25%), insufficient logging (18%), and pre-ransomware activity involving Rhysida and MoneyMessage were key security gaps.
Threat Actors
Malware
MoneyMessageMFA weaknesses (35%), exposed infrastructure including CVE-2025-20393 and CVE-2023-20198 (25%), insufficient logging (18%), and pre-ransomware activity involving Rhysida and MoneyMessage were key security gaps.RhysidaMFA weaknesses (35%), exposed infrastructure including CVE-2025-20393 and CVE-2023-20198 (25%), insufficient logging (18%), and pre-ransomware activity involving Rhysida and MoneyMessage were key security gaps.
Vendors
CiscoPhishing returned to the top initial-access method in Q1 2026, accounting for over a third of engagements where initial access could be determined, according to Cisco Talos.GitHubin ToolShell SharePoint exploitation, the first Talos sighting of Crimson Collective using exposed GitHub tokens to access Azure via Microsoft Graph, and persistent MFA and logging gaps enabling attacks.Microsoftthe first Talos sighting of Crimson Collective using exposed GitHub tokens to access Azure via Microsoft Graph, and persistent MFA and logging gaps enabling attacks.SoftrTalos also documented novel abuse of the AI web-builder Softr to host Exchange/OWA credential-harvesting pages, a decline in ToolShell SharePoint exploitation, the first Talos sighting of Crimson Collective using
Products
Azureexploitation, the first Talos sighting of Crimson Collective using exposed GitHub tokens to access Azure via Microsoft Graph, and persistent MFA and logging gaps enabling attacks.Cisco IOS XEExploited weaknesses included CVE-2025-20393 in Cisco Secure Email Gateway and CVE-2023-20198 in Cisco IOS XE, along with exposed WinRM management ports accessible from the internet.Cisco Secure Email GatewayExploited weaknesses included CVE-2025-20393 in Cisco Secure Email Gateway and CVE-2023-20198 in Cisco IOS XE, along with exposed WinRM management ports accessible from the internet.DuoAttackers bypassed MFA by registering new devices to compromised accounts and, in one case, configuring an Outlook client to connect directly to an Exchange server, sidestepping Duo MFA requirements entirely.GitHubin ToolShell SharePoint exploitation, the first Talos sighting of Crimson Collective using exposed GitHub tokens to access Azure via Microsoft Graph, and persistent MFA and logging gaps enabling attacks.Microsoft Exchangeweb application development platform, to build a credential harvesting page that mimicked Microsoft Exchange and Outlook Web Access login screens.Microsoft Graphthe first Talos sighting of Crimson Collective using exposed GitHub tokens to access Azure via Microsoft Graph, and persistent MFA and logging gaps enabling attacks.Outlook on the webdevelopment platform, to build a credential harvesting page that mimicked Microsoft Exchange and Outlook Web Access login screens.SoftrTalos also documented novel abuse of the AI web-builder Softr to host Exchange/OWA credential-harvesting pages, a decline in ToolShell SharePoint exploitation, the first Talos sighting of Crimson Collective using