IR Trends Q1 2026: Phishing reemerges as top initial access vector, as attacks targeting public administration persist
Summary: Cisco Talos IR reported that phishing reemerged as the top initial access vector in Q1 2026, accounting for over a third of engagements where initial access could be determined, and that public administration and health care were tied as the most targeted verticals. Talos documented its first use of a specific AI tool by an adversary in a phishing campaign, with the Softr AI-based web application development service used to generate a credential harvesting page targeting Microsoft Exchange and Outlook Web Access accounts.
What you should know: Talos assesses with moderate confidence that actors have used Softr's AI-powered platform since at least May 2023 with increasing frequency, and a phishing page can now be built with a few AI prompts and no code, with captured data routed to a disposable store like Google Sheets. Meanwhile, 35 percent of engagements involved MFA weaknesses, including actors bypassing MFA by registering new devices to previously compromised accounts.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026