Prophet Security Report Finds Stolen Sessions Drove Many Account Attacks
Summary
Prophet Security says its May–July 2026 investigations found identity was targeted in roughly half of confirmed malicious activity. Stolen sessions, browser-delivered infostealers, targeted phishing, and unmonitored assets featured prominently.
Key points
- Prophet Security investigated every alert in customer environments from May 1 to July 31, 2026; about 7% of completed investigations were classified as confirmed malicious.
- Identity was targeted in roughly half of confirmed malicious activity. The report says attackers using already-authenticated sessions often bypassed controls that blocked password-based attempts.
- Infostealers affected roughly a quarter of investigated organizations and were mostly delivered through browsers, including via fake updates, malicious ads, sponsored search results, and ClickFix lures.
- Credential phishing was the largest single category of confirmed malicious activity at about 28%; campaigns often repeatedly targeted finance personnel and used mailbox rules to hide messages.
- Long-running intrusions often involved devices without endpoint agents. The report describes credential attacks, lateral movement, and pre-ransomware activity on unmonitored assets.
- The report warns that stolen sessions, hidden inbox rules, and remote-support tools can persist after a password reset; it says two attacks were stopped before ransomware deployment.
Article Details
- Publisher
- Prophet Security
- Report Period
- 2026-05-01 to 2026-07-31
- Scope
- Investigations of alerts across customer environments; statistics are rounded and exclude authorized penetration tests and red-team exercises.
- Sample Size
- 4.7 million questions asked of customer environments; median of 35 questions per investigation.
- Key Statistics
- About 93% of completed investigations were benign and 7% were confirmed malicious.
- Credential phishing represented about 28% of confirmed malicious activity.
- Malicious code execution and tooling represented about 23% of confirmed malicious activity.
- Direct attacks on accounts and sessions represented about 18% of confirmed malicious activity.
- Pre-ransomware and manual attacker activity represented about 9% of confirmed malicious activity.
- Recommendations
- Incident response should revoke active sessions and address persistence, rather than relying on a password reset alone.
- Compare endpoint-agent coverage with authentication logs to identify unmonitored machines authenticating to the network.
MITRE ATT&CK
T1003.001 · LSASS MemoryAttackers accessed LSASS to obtain credential data.T1114.003 · Email Forwarding RuleAttackers modified inbox rules to hide or delete incoming emails.T1219 · Remote Access ToolsAttackers used commercial remote-access and remote-support software to maintain access.T1539 · Steal Web Session CookieA described script decrypted browser cookie storage and extracted authentication cookies.T1550.004 · Web Session CookieAttackers replayed stolen authenticated session cookies to bypass normal authentication controls.T1555.003 · Credentials from Web BrowsersThe article describes extracting browser-stored cookies.T1562.001 · Disable or Modify ToolsA trojanized installer disabled Windows Defender.T1566 · PhishingCredential-phishing campaigns used targeted emails to steal credentials or sessions.T1621 · Multi-Factor Authentication Request GenerationAttackers used repeated MFA prompts and push bombing to induce user approval.
Malware
AsyncRATWe identified delivery tools like ClearFake and SocGholish, and payloads including Lumma Stealer, Vidar, HijackLoader, and AsyncRAT.ClearFakeWe identified delivery tools like ClearFake and SocGholish, and payloads including Lumma Stealer, Vidar, HijackLoader, and AsyncRAT.HijackLoaderWe identified delivery tools like ClearFake and SocGholish, and payloads including Lumma Stealer, Vidar, HijackLoader, and AsyncRAT.Lumma StealerWe identified delivery tools like ClearFake and SocGholish, and payloads including Lumma Stealer, Vidar, HijackLoader, and AsyncRAT.SocGholishWe identified delivery tools like ClearFake and SocGholish, and payloads including Lumma Stealer, Vidar, HijackLoader, and AsyncRAT.VidarWe identified delivery tools like ClearFake and SocGholish, and payloads including Lumma Stealer, Vidar, HijackLoader, and AsyncRAT.
Vendors
Products
Prophet AI SOC AnalystThese findings are based on investigations completed by the Prophet AI SOC Analyst between May 1 and July 31, 2026.Windows DefenderFor example, a trojanized version of a popular AI application ran from a downloads folder, disabled Windows Defender, set up a highly privileged scheduled task, and opened command-and-control channels.