IR Trends Q2 2026: Phishing and RMM Weaponization

In Q2 2026, phishing surged as the primary initial access vector, appearing in over half of analyzed engagements. Attackers are increasingly using QR code-embedded PDFs and trusted cloud platforms to bypass email security gateways. A newly identified threat actor, UAT-11764, specifically targeted Australian organizations by leveraging compromised Microsoft 365 accounts and SharePoint to propagate attacks via internal contact lists.

Technically, the quarter was marked by a spike in authentication abuse, with 65 percent of engagements involving MFA bypass via Adversary-in-the-Middle (AitM) proxies, session-token theft, and the use of platforms like ARToken for OAuth device-code phishing. Ransomware operators, including the newly observed Sinobi group and Warlock (Storm-2603), have shifted toward weaponizing legitimate Remote Monitoring and Management (RMM) tools such as MeshAgent and Zoho Assist. These tools allow actors to blend into administrative traffic and maintain stealthy, SYSTEM-level persistence.

Healthcare remains the most targeted sector due to low downtime tolerance, followed by public administration and manufacturing. The increasing sophistication of Phishing-as-a-Service (PhaaS) platforms and the strategic use of Group Policy Objects (GPO) for ransomware deployment underscore the need for organizations to move toward phishing-resistant MFA and behavior-based monitoring of administrative tools.