Huntress Ranks Common Cyber Tactics by Prevalence and Business Disruption Risk
Summary
Huntress’s Tragic Quadrant ranks cyber tactics by prevalence and disruption risk, highlighting RMM abuse, mailbox manipulation, and AiTM account takeover while discussing device-code phishing, ClickFix, and AI platform abuse.
Key points
- The ranking draws on Huntress telemetry, SOC investigations, and data from more than 5 million endpoints and 15 million identities across nearly 300,000 organizations.
- RMM abuse appeared in 45% of endpoint-related incidents Huntress investigated in Q1 2026.
- Mailbox manipulation accounted for 24.6% of ITDR signals so far in 2026 and can enable BEC scams through hidden inbox rules.
- AiTM attacks represented 18.9% of identity-based threats Huntress tracked in 2025, allowing attackers to reuse stolen session tokens and bypass fresh MFA prompts.
- A 16-day EvilTokens phishing campaign used device-code flows and legitimate infrastructure to target 344 organizations across five countries.
- ClickFix made up about 2.2% of 2026 Managed EDR detection signals; nearly 99% of those detections were rated high severity.
- Huntress describes malicious content distributed through trusted AI platforms as an emerging, currently overhyped tactic.
Article Details
- Topic
- Huntress’s ranking of prevalent cyber tactics by their potential to disrupt businesses
People
Malware
LummaC2Figure 3: A fake "Human Verification" prompted a victim to press Win+R, then paste one command into the Windows Run box. That launched a multi-stage infection ending in a LummaC2 infostealer compromise.SectopRATFigure 4: FakeAgent used a malicious Claude Artifact hosted on the real claude.ai domain to send people looking for Claude Desktop to SectopRAT, hitting 29 organizations in two days.