10 minhigh
IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains
Talos IR's Q2 2026 report highlights a sharp rise in phishing-driven initial access (over 50% of engagements) and authentication abuse (65% of engagements), with attackers increasingly using QR-code PDFs, OAuth device-code phishing, and AitM proxies to bypass MFA. Ransomware actors including Sinobi and Warlock (Storm-2603) weaponized legitimate RMM tools—a trojanized MeshAgent binary and Zoho Assist—for stealthy, durable C2 and remote access, blending malicious activity into normal administrative traffic. The report also details a new PhaaS platform, ARToken, and a QR-phishing campaign attributed to UAT-11764 that abuses M365 and SharePoint infrastructure for credential harvesting and self-propagation.
Conf:high
Detection / HunterAnthropic
What Happened
Cisco Talos published its quarterly incident response trends report, showing that attackers are increasingly getting into organizations through phishing emails, including cleverly designed PDFs with QR codes that trick email security filters. Once inside, attackers are frequently bypassing multi-factor authentication (extra login verification steps) using various tricks. Hospitals, government offices, and manufacturers were hit hardest this quarter, likely because they can't afford system downtime. Ransomware gangs also found new ways to sneak into networks by disguising themselves as legitimate remote IT support tools, making them harder to spot. This matters because it shows attackers are getting better at hiding in plain sight and defeating security measures many organizations rely on. Organizations should strengthen their login security with phishing-resistant verification methods, improve their system logging so they can detect and investigate attacks, and closely monitor use of remote administration tools for signs of abuse.
Key Takeaways
- Phishing was the primary initial access vector in over half of Talos IR engagements this quarter, up from about a third last quarter, with attackers using QR code-embedded PDFs and trusted cloud platforms to bypass email gateways.
- Authentication abuse spiked to 65% of engagements (from 35%), with adversaries using AitM proxies, session-token theft, MFA fatigue attacks, and self-enrolled devices to bypass MFA.
- Sinobi ransomware operators weaponized a trojanized MeshAgent binary (from the legitimate MeshCentral RMM platform) as a covert C2 backdoor installed as a SYSTEM-level service, communicating over encrypted WebSocket, enabling roughly three days of undetected access before ransomware deployment.
- Warlock ransomware operators (Storm-2603) deployed Zoho Assist Unattended Agent to gain persistent, stealthy remote access without an active user session.
- A newly identified threat actor, UAT-11764, runs an ongoing QR phishing campaign against Australian organizations that abuses compromised M365 accounts and SharePoint to harvest credentials and self-propagate via contact lists.
- A phishing-as-a-service platform called ARToken, linked to EvilTokens, provides a full post-compromise toolkit for M365 account takeover including OAuth device-code phishing, primary refresh token (PRT) persistence, and SharePoint exfiltration.
Affected Systems
- Microsoft 365 accounts and tenants
- Active Directory domain controllers (ntds.dit)
- Windows endpoints and servers
- Internet-facing SD-WAN and perimeter VPN appliances
- Health care, public administration, and manufacturing sector organizations
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing (QR-code PDFs, OAuth device-code phishing, AitM proxies) or exploitation of exposed infrastructure grants adversary a foothold
- Credential/Session Theft: MFA bypassed via AitM proxy, session-token theft, MFA fatigue, or self-enrolled devices
- Persistence: Trojanized RMM tools (MeshAgent, Zoho Assist) installed as SYSTEM-level services or malicious inbox rules created to hide phishing activity
- Lateral Movement: Actors use RDP/WinRM and cracked service account credentials (sourced from ntds.dit) to move across the domain
- Domain-Wide Deployment: Ransomware pushed via malicious GPO logon script for mass encryption
- Exfiltration and Impact: Data staged and exfiltrated via tools like rclone.exe before file encryption with ransomware-specific extensions
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article provides a MITRE ATT&CK technique table and general behavioral guidance but does not include specific YARA, Sigma, Snort/Suricata, KQL, SPL, EQL, or other detection query content.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Legitimate RMM tools (MeshAgent, Zoho Assist) and native administrative protocols (RDP, WinRM) are abused, which may not trigger EDR alerts by default since these are recognized as legitimate software; behavioral analytics on service creation, unusual RMM installs, and process ancestry would be needed to catch this activity. |
| Network Visibility | Medium | C2 traffic is tunneled over encrypted WebSocket and standard web protocols, blending with legitimate traffic; NetFlow and TLS inspection could reveal anomalous destinations but the article notes many organizations lack sufficient NetFlow or retention to reconstruct this activity. |
| Detection Difficulty | Hard | Attackers deliberately use legitimate tools (RMM software, valid accounts, standard web protocols) and native administrative features (GPOs, inbox rules) to blend in with normal activity, requiring behavior-based rather than signature-based detection. |
Required Log Sources
- Domain controller security event logs (with adequate retention)
- Host process-creation and command-line logging (e.g., Windows Event ID 4688, Sysmon Event ID 1)
- Windows service creation events (Event ID 7045)
- Cloud identity provider / Microsoft Graph API audit logs
- Email inbox rule creation and mailbox audit logs
- NetFlow / network traffic logs
- SharePoint/OneDrive file access and sharing logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for RMM agent installations (e.g., MeshAgent, Zoho Assist) that were not deployed through approved software management channels or that appear as newly installed SYSTEM-level services. | Windows service creation logs, EDR process/service telemetry, software inventory baselines | Persistence / Command and Control | Medium - legitimate IT teams may deploy these tools for support, requiring correlation with change management records |
| Hunt for anomalous inbox rule creation that hides, forwards, or deletes emails, particularly rules created shortly after suspicious authentication events. | Mailbox audit logs, Microsoft Graph API logs (T1564.008) | Persistence / Defense Evasion | Low to Medium - users occasionally create legitimate rules, but bulk or suspicious keyword-based rules are less common |
| Monitor for OAuth device-code authentication flows completed from unusual devices or locations shortly after a user reports a phishing email. | Azure AD / Entra ID sign-in logs, Conditional Access logs | Initial Access / Credential Access | Medium - legitimate device-code flows exist for certain apps and services |
| Detect access to or unusual copying of the ntds.dit file or use of volume shadow copy/ntdsutil-like activity outside of scheduled backup windows. | File access auditing on domain controllers, process creation logs, Sysmon | Credential Access | Low - legitimate access to ntds.dit is rare outside backup processes |
| Identify large spikes in outbound email volume from a single mailbox that could indicate account compromise and phishing propagation. | Email gateway logs, mail flow/transport logs, outbound email rate metrics | Lateral Movement / Command and Control | Low - large legitimate email campaigns are typically sent from designated bulk-mail systems, not individual user mailboxes |
Control Gaps
- Signature-based antivirus/EDR is unlikely to flag legitimate, digitally-signed RMM binaries repurposed for malicious use
- Push- and SMS-based MFA does not stop AitM proxy or session-token theft attacks
- Short log retention (e.g., a few hours on domain controllers) prevents retrospective investigation of initial access and lateral movement
- Lack of NetFlow or centralized logging can prevent reconstruction of exfiltration and external authentication activity
- Unlimited outbound email thresholds allow compromised mailboxes to send large volumes of phishing/spam before detection
Key Behavioral Indicators
- Unexpected installation of remote management/RMM software as a new SYSTEM-level service outside change management processes
- Encrypted WebSocket connections from endpoint processes not typically associated with such traffic
- Newly created or modified inbox rules that hide, auto-forward, or delete incoming mail
- Use of valid domain administrative credentials for RDP/WinRM sessions inconsistent with typical administrative behavior patterns
- GPO modifications introducing new logon scripts shortly before mass file encryption events
- Sudden spikes in outbound email volume from a single user mailbox
False Positive Assessment
Medium - Detection relies heavily on behavioral analytics for legitimate tools (RMM software, valid accounts, standard protocols) that are also used for benign IT administration, so tuning is required to distinguish malicious use from normal operations.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting; consider isolating hosts running unauthorized or unexpected RMM agents if your EDR supports host isolation.
- Consider reviewing recently created email inbox rules across mailboxes for signs of hiding or auto-forwarding behavior.
- Evaluate whether outbound email rate limiting can be enforced immediately to contain any ongoing mailbox compromise.
- Consider auditing service account permissions and rotating credentials for any accounts with weak or shared passwords, particularly those with domain administrative rights.
Infrastructure Hardening
- Evaluate transitioning from push- and SMS-based MFA to phishing-resistant methods such as FIDO2/WebAuthn or hardware security keys, where feasible.
- Consider restricting self-service MFA enrollment by requiring helpdesk verification for new device registration.
- Evaluate blocking legacy authentication protocols via Conditional Access policies.
- Consider implementing centralized logging with a minimum of 90 days retention across servers, workstations, network infrastructure, cloud identity providers, and security appliances.
- Evaluate deploying application allowlisting to prevent unauthorized RMM or administrative binaries from running as services.
- Consider identifying and prioritizing patching or decommissioning of end-of-life and internet-exposed systems, and restrict management interfaces behind VPN or trusted-source access.
- Evaluate deploying a Web Application Firewall (WAF) with rules addressing known exploitation patterns for internet-facing applications.
User Protection
- Consider implementing email gateway policies that block or flag QR codes embedded within PDF attachments.
- Evaluate enforcing Conditional Access policies that condition access on device compliance and trusted infrastructure rather than geography alone.
- Consider monitoring for anomalous SharePoint file staging or sharing activity as a potential post-compromise indicator.
- Evaluate monitoring for OAuth device-code authentication flows for signs of abuse.
Security Awareness
- Consider incorporating awareness training on QR-code phishing (quishing) tactics into existing security education programs.
- Evaluate educating users on the risks of approving unexpected MFA push notifications (MFA fatigue) and how to report them.
- Consider periodic reminders to employees about verifying vendor-impersonation phishing lures, especially those referencing trusted platforms like Microsoft 365 or SharePoint.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping33 techniques
Tactic
Reconnaissance
Tactic
Initial Access
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Discovery
Tactic
Lateral Movement
Tactic
Command and Control
Tactic
Impact
Additional IOCs
- File Paths:
ntds.dit- Active Directory domain credential store targeted by Sinobi actors to obtain a service account password for lateral movement
- Command Lines:
- Purpose: Deploy ransomware domain-wide via Group Policy logon script following lateral movement | Tools:
Group Policy Object,logon script| Stage: Impact / Execution - Purpose: Exfiltrate staged data from compromised environment prior to ransomware deployment | Tools:
rclone.exe| Stage: Exfiltration
- Purpose: Deploy ransomware domain-wide via Group Policy logon script following lateral movement | Tools:
- Other:
.SINOBI- File extension appended to files encrypted by Sinobi ransomware
