Check Point’s 2026 Report Highlights Social Engineering and Unmonitored Infrastructure Risks
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Check Point’s 2026 report says ClickFix activity rose approximately 500% in 2025, while attackers expanded voice impersonation, exploited unmonitored infrastructure and targeted AI-connected workflows.
Key points
- Check Point reports that ClickFix activity increased approximately 500% year over year in 2025 and appeared in nearly half of documented malware campaigns, using fake verification or troubleshooting steps to induce malicious execution.
- Social engineering expanded across phone calls, messaging apps and collaboration platforms. Observed Teams campaigns impersonated IT support and persuaded employees to install remote-access tools.
- Chinese-linked espionage groups and ransomware operators exploited low-visibility routers, firewalls, VPN appliances and virtualization systems for persistent access, credential theft and lateral movement.
- The report describes indirect prompt injection through calendars, emails and documents that could manipulate AI assistants into unintended tool use or sensitive-data disclosure.
- A Lakera review found security vulnerabilities in 40% of approximately 10,000 probed MCP servers; 8% exposed at least one secret API key.
- Check Point’s Q4 2025 GenAI Protect data classified one in 41 submitted prompts as high risk, with common exposures including personal information, internal IT artifacts and source code.
- Recommendations include retiring end-of-life infrastructure, improving appliance monitoring and forensic visibility, validating layered defenses and hardening business workflows against impersonation.
Article Details
- Publisher
- Check Point Software Technologies Ltd.
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Global cyberattack telemetry, reported incidents, social engineering, nation-state operations, unmonitored infrastructure, AI security, and exploited vulnerabilities.
- Sample Size
- Not disclosed
- Key Statistics
- Check Point telemetry recorded an average of 1,968 cyberattacks per organization per week in 2025, up 18% year over year and nearly 70% since 2023.
- Education was the most targeted industry globally in 2025, averaging 4,352 attacks per organization per week, up 22% year over year.
- In 2025, email accounted for 82% of observed file-based attack delivery and web delivery for 18%; approximately one in 68 emails with attachments received by organizations was malicious.
- Lakera found security vulnerabilities in 40% of approximately 10,000 probed MCP servers; 8% exposed at least one secret API key.
- More than 46% of exploitation attempts in the report's 2025 attack data leveraged CVEs published before 2020, while vulnerabilities disclosed in 2025 accounted for 4%.
- Recommendations
- Retire end-of-life devices and improve monitoring, forensic artifacts, and security controls on supported network appliances.
- Continuously validate layered preventive controls and prioritize remediation using exposure intelligence and observed attacker activity.
- Limit data exposure through segmentation, least privilege, immutable backups, and regularly exercised incident-response playbooks.
- Continuously govern cloud, SaaS, AI, and third-party access, including configuration drift, API usage, service trust, defined ownership, and monitored usage boundaries.
- Require context-aware verification for high-risk payment, vendor, and access-granting actions, eliminating single-step approvals and implicit trust.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolOperators used Remote Desktop Protocol for lateral movement and interactive post-compromise operations.T1040 · Network SniffingSandworm abused native traffic-capture capabilities on misconfigured network devices to intercept credentials, cookies, and tokens.T1078 · Valid AccountsAttackers reused harvested credentials to access VPNs, identity providers, and cloud management consoles.T1190 · Exploit Public-Facing ApplicationThreat actors exploited internet-facing SharePoint, WSUS, VPN appliances, and other exposed enterprise systems for initial access.T1204.002 · Malicious FileVictims were induced to execute malicious files, including JavaScript files dropped through SVG smuggling.T1485 · Data DestructionAPT44 deployed wiper malware against Ukrainian government, energy, logistics, and agricultural systems.T1486 · Data Encrypted for ImpactRansomware operators deployed encrypting payloads after compromising perimeter appliances and enterprise servers.T1528 · Steal Application Access TokenConsentFix stole OAuth authorization codes and used them to obtain tokens for access to Microsoft accounts.T1539 · Steal Web Session CookieOperators harvested session cookies from intercepted network traffic and compromised endpoints.T1562.001 · Disable or Modify ToolsUNC3886 implants patched legitimate Junos OS daemons in memory to suppress logging and telemetry.T1566.001 · Spearphishing AttachmentAttackers delivered malicious ZIP, HTML, SVG, and other attachments through phishing emails.T1566.002 · Spearphishing LinkUNC6229 used phishing links during fake recruitment interactions to steal credentials.T1566.003 · Spearphishing via ServiceAttackers used external messaging and collaboration services, including Microsoft Teams, to impersonate IT support and obtain initial access.T1566.004 · Spearphishing VoiceVoice-phishing operators impersonated IT support and help desks to induce credential disclosure and access changes.T1574.002 · DLL Side-LoadingChinese-nexus operations used DLL side-loading to execute ShadowPad and other malicious payloads under trusted software.
CVE
CVE-2024-21762The group was observed exploiting CVE-2024-21762CVE-2024-40766tied to ongoing abuse of CVE-2024-40766. ThisCVE-2024-55591Ransomware: and CVE-2024-55591, which affected FortiOS andCVE-2025-0282activity targeting networks across the globe, CVE-2025-0282 and CVE-2025-22457, to deployCVE-2025-21590MARCH 12 Disclosure of UNC3886 exploiting CVE-2025-21590 in JuniperCVE-2025-22457activity targeting networks across the globe, CVE-2025-0282 and CVE-2025-22457, to deployCVE-2025-24472CVE-2024-55591 and CVE-2025-24472, both of whichCVE-2025-3248(CVE-2025-3248) leak enabled large-scale data theft, includingCVE-2025-49704vulnerabilities involving CVE-2025-49704CVE-2025-49706and CVE-2025-49706, with later variantsCVE-2025-53770designated as CVE-2025-53770 and CVE-2025-CVE-2025-55182versions prior to 1.3.0. The flaw fails to require 4. React2Shell (CVE-2025-55182)CVE-2025-59287weaponization cycle is CVE-2025-59287, a remote inside the Windows update infrastructure, onCVE-2025-61884the initial step in an espionage operation, while in CVE-2025-61884 is a critical server-side request
People
ALEXANDRA GOFMANThreat Intelligence Technology Leader quoted on persistent footholds in low-visibility edge infrastructure.ELI SMADJASecurity Research Group Manager quoted on nation-state threats as a standing operational risk.JONATHAN FISCHBEIField CISO credited with the report's CISO recommendations.Lotem FinkelsteinVP Research who authored the report introduction.Marco RubioUS Secretary of State identified as a target of AI-enabled voice impersonation.MICHAEL ABRAMZONThreat Intelligence and Research Architect quoted on AI attack surfaces and governance.MICHAEL GREENBERGHead of Product Marketing, Exposure Management, quoted on applying threat intelligence before compromise.OMER DEMBINSKYData Research Group Manager quoted on unified visibility and continuous exposure management.SERGEY SHYKEVICHThreat Intelligence Group Manager quoted on multichannel social engineering.YOAV ARAD PINKASThreat Intelligence Analyst quoted on persistent cyber operations integrated with conflict.
Threat Actors
0ktapusExplicitly identified as another tracking name for Scattered Spider, also tracked as UNC3944.APT28Russian-affiliated group to which CERT-UA attributed LAMEHUG malware using an AI model to generate reconnaissance commands.ARMORY CASTLEChinese-affiliated espionage actor exploiting Ivanti appliances and associated with SPAWN implants and BRICKSTORM.Cl0pExtortion operation whose associated actors reportedly exploited Oracle E-Business Suite to steal business-critical data.Earth LamiaChina-affiliated group observed exploiting React2Shell for malicious activity.Educated ManticoreIranian APT group using messaging platforms such as WhatsApp for social engineering.FunkSecRansomware group that acknowledged using AI assistance for portions of its coding and tooling.GTG-1002China-affiliated group that, according to Anthropic, manipulated Claude Code to perform most tactical tasks in an espionage operation targeting approximately thirty organizations.InkDragonActor using ToolShell for initial access and ShadowPad or FinalDraft for post-exploitation, lateral movement, and data exfiltration.Jackpot PandaChina-affiliated group observed exploiting React2Shell for malicious activity.KH NightmareCambodian-aligned hacktivist group reported to have leaked approximately 800GB of alleged government data during Thai-Cambodian tensions.LAPSUS$Group associated with the Scattered LAPSUS$ Hunters ecosystem and an earlier Okta compromise through a third-party support provider.Mora_001Actor exploiting FortiOS vulnerabilities, creating VPN accounts, moving laterally, and deploying SuperBlack ransomware.Nimbus ManticoreIranian APT group observed impersonating business professionals on LinkedIn.Predatory SparrowConducted disruptive attacks against Bank Sepah and Nobitex; sponsorship and strategic direction were not independently confirmed.Rude PandaAPT group compromising Microsoft IIS servers through publicly available static ASP.NET machine keys and deploying HijackServer.Salt TyphoonChinese-affiliated espionage actor targeting telecommunications and other infrastructure internationally, including through compromised routers and trusted connections.SandwormExplicitly identified as another name for APT44; also attributed a campaign abusing misconfigured network devices to intercept traffic and harvest authentication material.SANDWORM RELICRussian-linked group explicitly also tracked as Sandworm; deployed destructive malware against Ukrainian infrastructure alongside physical strikes.Scattered Lapsus$ HuntersCollective described as a joint effort involving operators, tooling, and tactics associated with Scattered Spider, LAPSUS$, and ShinyHunters; linked to enterprise intrusions and a leaked Oracle EBS exploit.Scattered SpiderIdentity-focused intrusion cluster linked to the Marks & Spencer compromise; explicitly also tracked as UNC3944 and Octo Tempest.ShinyHuntersVoice-phishing actor targeting Salesforce environments for data theft and extortion; explicitly also tracked as UNC6040. Its claimed victim and record counts remain unverified.UAT4356China-nexus actor exploiting Cisco ASA-5500-X firewalls and deploying platform-specific implants, including the Ray Initiator bootkit.UNC3886China-nexus actor exploiting Junos OS to deploy stealthy implants and suppress appliance telemetry.UNC3944Explicitly identified as another tracking name for Scattered Spider, also tracked as Octo Tempest.UNC6040Explicitly identified as another tracking name for ShinyHunters, which conducted voice-phishing attacks against Salesforce environments.UNC6229Targeted marketing and digital advertising personnel using fake job postings, phishing, and malicious payloads to hijack corporate accounts.
Malware
Akiraexploitation or misconfiguration, unmonitored involved Akira ransomware. In mid-2025, anBRICKSTORMBRICKSTORM, malware designed for stealth access does not always require powerful newLAMEHUG(CERT-UA) reported LAMEHUG, a malware an AI model acting not merely as a content or codeLummaincluding by established cyber criminal groups behind major infostealer operations, such as RedLine and Lumma, and in attacks that delivered payloads leading to Interlock ransomware infections.PlugXPlugX, and higher-end capabilities, including Notably, this campaign underscores that globalQilinQilin, a ransomware-as-a-service platform typicallyRedLinelandscape, including by established cyber criminal groups behind major infostealer operations, such as RedLine and Lumma, and in attacks that delivered payloads leading to Interlock ransomware infections.ShadowPadaccess platforms, such as ShadowPad and trusted connections to pivot into other networks.SPAWNincluding telecommunications, government, custom platform-specific SPAWN malware.SuperBlackSuperBlack, built using a leaked LockBit builder.
Vendors
Anthropiccame from Anthropic’s investigation into the China-Ciscofor the ArcaneDoor campaign, targeted Cisco nearly all continents in which initial access andF5 NetworksOCTOBER 15 F5 Networks discloses a long-term compromise of its BIG-IPFortinetThe U.K. National Cyber Security Centre (NCSC) Fortinet devices. In intrusions involving JuniperGooglemalicious Google Calendar invitations that enabling arbitrary commands to run in the hostIvantithroughout 2025, particularly targeting IvantiJuniper Networksvulnerability in Junos OS, Juniper Networks’ The attackers gained administrative accessMicrosoftIt tricks users into completing a legitimate Microsoft/Azure OAuth login flow.OpenAIcommand injection vulnerability in OpenAI’sSonicWalldevices have become a critical and increasingly increase in Akira intrusions targeting SonicWall
Products
Cisco ASA-5500-XCVE-2025-20362 against Cisco ASA-5500-X firewallsClaude Codeto Anthropic’s analysis, Claude Code handledCodex CLICodex CLI, an AI-powered coding assistantCursorsuch as Cursor and VS Code plugins, and theESXiknowledge, source code, and undisclosed infrastructure, including VMware vCenter and ESXi.FortiOSRansomware: and CVE-2024-55591, which affected FortiOS andFortiProxyFortiProxy SSL VPN devices. The first vulnerabilityIvanti Connect Securevulnerabilities in Ivanti Connect Secure appliances,Junos OSundocumented toolkit. directly with legitimate Junos OS daemons,Langflowhas been confirmed. Compromised LangflowMicrosoft SharePointMicrosoft SharePoint servers. Although publiclyOracle E-Business Suiteon vulnerable on-prem SharePoint servers. 3. Oracle E-Business SuiteReactReact Server Components (RSC). It stems fromSonicWall SSL VPNactors, providing a low-friction path to stealthy unauthorized access through SonicWall SSL VPNVMware vCenter Serverknowledge, source code, and undisclosed infrastructure, including VMware vCenter and ESXi.
Tools
DeepFaceLiverapidly. Tools such as DeepFaceLive now operateIUAM ClickFix GeneratorAs we saw with phishing kits, ClickFix began to commoditize by creating kits such as the IUAM ClickFix Generator, which enables attackers to create highly customizable, cross-platform ClickFix campaigns and rapidlyXanthoroxAround the same time, the Xanthorox project dynamically and on demand, producing polymorphic
Countries
ChinaMultiple other China-affiliated actors are long-term access to victim environments andIndiathose observed in other regions. Within APAC, India through an unpatched Cisco device. Cellcom in theIranDestructive attacks, ransomware campaigns, and Iran, where disruptive cyber operations targetedIsraelthe Shamir Medical Center in Israel. The intrusionNorth KoreaChina, Iran, and North Korea continue to prioritizeRussiaRussia’s cyber operations showed a similar Direct effect activity includes cyber operationsTaiwanWithin APAC, Taiwan and China were the mostUkraineRussia’s cyber activity in Ukraine showed aUnited KingdomPublic arrest records and indictments name individuals with United States, United Kingdom, and European citizenship.United StatesRecent examples include the MonsterV2 infostealer campaign targeting United States residents and a PureHVNC RAT campaign analyzed by Check Point Research.
Industries
Agricultureattacks against logistics, agriculture, and energy impacts.AutomotiveAutomotive 1986 [+28%]EducationEducation 4352 [+22%]Energy & UtilitiesEnergy & Utilities 2168 [+37%]Financial Servicesand financial services. Iranian-linked actors disruption to the networks but also complicatedGovernmentfinancial institutions, government services, and impact attacks, first against Bank Sepah,Hardware & SemiconductorsHardware & Semiconductors 1893 [+34%]Healthcare & MedicalHealthcare & Medical 2365 [+7%]Industrial ManufacturingIndustrial Manufacturing 1567 [+19%]Telecommunicationsincluding telecommunications, government, custom platform-specific SPAWN malware.