Guardz MSP Threat Report Finds Rising Session Hijacking and RMM Abuse
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Guardz’s 2026 MSP threat report analyzes September 2025–February 2026 telemetry, reporting a 23% rise in session hijacking and increased abuse of remote management tools across monitored SMB environments.
Key points
- The report draws on billions of audit events from MSP-managed SMB environments across North America, EMEA and APAC, covering authentication, email, endpoint and cloud activity.
- Guardz reports session hijacking incidents rose approximately 23% over 180 days while affected accounts remained near 20,000, suggesting repeated session abuse against existing victims.
- OAuth consent events increased 45% between October 2025 and January 2026, then another 24% in February; consent activity is not necessarily malicious.
- Ransomware behavioral detections rose 190% over a separate 50-day window, driven primarily by a confirmed lateral-movement campaign and increased RMM tool flagging, rather than establishing an equivalent rise in confirmed ransomware attacks.
- RMM abuse accounted for approximately 26% of endpoint-related threats, with ScreenConnect, MeshAgent and Atera agents among the tools flagged for unauthorized access or persistence.
- Confirmed BEC fraud incidents analyzed in 2026 ranged from $140,000 to $1.5 million; the report identifies malicious inbox rules as a leading persistence mechanism.
- Recommendations include phishing-resistant MFA, session monitoring, OAuth consent governance, verification of RMM deployments and out-of-band checks for high-value payments.
Article Details
- Publisher
- Guardz
- Report Period
- 180-day observation window spanning September 2025 through February 2026
- Scope
- Authentication, email, endpoint, and cloud productivity telemetry from MSP-managed SMB environments across North America, EMEA, and APAC.
- Sample Size
- Billions of audit events; total numbers of monitored organizations and users were not disclosed.
- Key Statistics
- Guardz reports that 89% of monitored SMBs have at least one user with confirmed credential compromise at any point in time.
- Session hijacking incidents increased approximately 23% over the 180-day observation period, while the affected population remained approximately 20,000 accounts.
- Reported Google Workspace OAuth abuse increased 2,000% between September 2025 and February 2026; absolute event counts were not provided.
- During the 180-day analysis, 114,827 successful BAV2ROPC logins, representing 4.5% of that protocol's traffic, were reported to have bypassed MFA.
- Ransomware behavioral detections increased 190% over a separate 50-day observation window; this measures detections rather than confirmed ransomware incidents.
- Recommendations
- Deploy phishing-resistant MFA and passwordless authentication using FIDO2 or passkeys.
- Monitor anomalous session reuse and device or location changes, and enforce short-lived session tokens.
- Implement application allowlisting and monitor RMM deployments with hash verification.
- Monitor OAuth consent grants and Graph API activity alongside mailbox audit logs.
- Require secondary out-of-band authentication for high-value financial transfers.
MITRE ATT&CK
T1018 · Remote System DiscoveryAdvanced IP Scanner and other detected scanning utilities were associated with internal network host discovery.T1046 · Network Service DiscoveryDetected network scanning utilities performed port scanning and service enumeration inside monitored environments.T1055 · Process InjectionThe report states that ransomware variants use process injection while abusing legitimate process names.T1068 · Exploitation for Privilege EscalationAttackers deploy vulnerable signed drivers to obtain kernel-level code execution and elevated privileges.T1098.005 · Device RegistrationPost-compromise attackers modify MFA settings and add attacker-controlled hardware keys to retain account access.T1110.003 · Password SprayingGuardz observed more than 14,000 unique password-spray IPs per month targeting at least 10 accounts each.T1110.004 · Credential StuffingThe report describes automated credential stuffing against SMB cloud accounts using breached credential data.T1114.003 · Email Forwarding RuleAttackers create inbox rules that forward financial communications to attacker-controlled external accounts.T1219 · Remote Access ToolsAttackers deploy remote management agents to establish persistent, encrypted command-and-control channels resembling legitimate IT traffic.T1486 · Data Encrypted for ImpactThe endpoint analysis identifies ransomware operations involving data encryption for impact and reports 560 ransomware threats over 180 days.T1539 · Steal Web Session CookieAiTM phishing attacks steal session cookies or authentication tokens to bypass login controls and MFA.T1550.004 · Web Session CookieThe report describes attackers reusing stolen authenticated sessions to access victim accounts without supplying credentials or completing MFA.T1562.001 · Disable or Modify ToolsThe driver-abuse analysis describes attackers using vulnerable drivers to disable EDR.T1574.002 · DLL Side-LoadingThe ransomware analysis describes DLL sideloading involving legitimate process names such as OfficeClickToRun.exe and SRService.exe.
CVE
People
Doni BrassSVP Product Strategy quoted on the convergence of AI capabilities used by defenders and attackers.Dor EisnerCEO & Co-Founder quoted on the increasing availability of sophisticated attack capabilities through commodity toolkits.Elli ShlomoHead of Security Research quoted on multi-stage attacks chaining identity, email, endpoint, and cloud activity.
Vendors
Google2026), covering authentication, email, endpoint, and cloud productivity data from Microsoft 365 and Google Workspace tenants across three monitored regions: North America, EMEA, and APAC.Guardz- [Connecting the Security Dots with Guardz](#connecting-the-security-dots-with-guardz)Microsoft2025 through February 2026), covering authentication, email, endpoint, and cloud productivity data from Microsoft 365 and Google Workspace tenants across three monitored regions: North America, EMEA, and APAC.
Products
Copilotvia phone calls. Video deepfakes are also appearing on collaboration platforms like Microsoft Teams and Copilot. A notable example occurred in 2024, when a Hong Kong-based employee at Arup was deceived during aDomotzindicating active internal reconnaissance. The presence of `domotz_nmap.exe` suggests abuse of the Domotz network monitoring platform as cover for scanning activity.Exchange Onlineuser had no MFA configured (or MFA was disabled for legacy auth); and the attacker received a valid Exchange Online access token, allowing them to read email, send email, create inbox rules, and exfiltrate dataGoogle Workspace2026), covering authentication, email, endpoint, and cloud productivity data from Microsoft 365 and Google Workspace tenants across three monitored regions: North America, EMEA, and APAC.Microsoft 365 Apps for Enterprisethrough February 2026), covering authentication, email, endpoint, and cloud productivity data from Microsoft 365 and Google Workspace tenants across three monitored regions: North America, EMEA, and APAC.Microsoft OneDrive| 1 | AnonymousLinkUsed | OneDrive | CRITICAL |Microsoft SharePoint| Application access | Outlook, Teams, SharePoint | Graph API, Azure PowerShell |Microsoft Teamscontrols via phone calls. Video deepfakes are also appearing on collaboration platforms like Microsoft Teams and Copilot. A notable example occurred in 2024, when a Hong Kong-based employee at Arup was deceived
Tools
Advanced IP Scanner- **Hacktools** at 1.6% (192 threats) are particularly concerning as they indicate active adversary operations; tools like Advanced IP Scanner and Nmap suggest internal network reconnaissance (`HIGH`).Advanced Port Scannerservice enumeration); `Advanced IP Scanner` (701+ detections for network host discovery); `Advanced Port Scanner` (144+ detections); `netscan.exe` (18+ detections).AteraAgent- `AteraAgent` (105+ detections): RMM agent deployment for persistent access.ISLOnline Agent- `ISLOnline Agent` (63+ detections): Remote support tool abuse.MeshAgent- `MeshAgent.exe` (190+ detections): Persistence with an invalid signature, unauthorized deployment.netscan.exeIP Scanner` (701+ detections for network host discovery); `Advanced Port Scanner` (144+ detections); `netscan.exe` (18+ detections).NinjaRMMAgentPatcher- `NinjaRMMAgentPatcher` (26+ detections): Patching/modification of existing RMM.Nmap- **Hacktools** at 1.6% (192 threats) are particularly concerning as they indicate active adversary operations; tools like Advanced IP Scanner and Nmap suggest internal network reconnaissance (`HIGH`).ScreenConnect.ClientSetup.exe- `ScreenConnect.ClientSetup.exe` (294+ detections): Remote access installation via command line.