IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains
Summary: Phishing appeared in over half of Cisco Talos Incident Response engagements this quarter, up from roughly a third last quarter, with attackers using QR code-embedded PDFs and links hosted on trusted cloud platforms to evade email gateways. Authentication abuse was observed in 65 percent of engagements versus 35 percent last quarter, as attackers bypassed MFA through adversary-in-the-middle proxies, session-token theft, MFA fatigue, and self-enrolled devices.
Bottom line: Talos responded to Sinobi ransomware for the first time, where operators used a trojanized MeshAgent binary as a SYSTEM-level auto-start service to hold undetected access for about three days before deploying ransomware domain-wide via a malicious GPO logon script - and health care led targeted sectors at 17 percent of engagements, where service interruption carries patient-care consequences.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026