LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses

What Happened

This report from security firm LevelBlue summarizes the most common cyberattack patterns their incident responders saw between April and June 2026. The biggest problem highlighted is that attackers are increasingly stealing and reusing legitimate login credentials, security codes, and app-to-app access tokens rather than breaking in through technical hacking alone—meaning multi-factor authentication (an extra login verification step) was defeated in every business email compromise case it was supposed to protect. This affects organizations of all sizes, but financial services, schools/universities, and legal firms were hit hardest, and mid-sized companies ($1M-$100M in revenue) were the most common victims. This matters because once attackers get valid access, they move through networks and cause damage much faster than before, giving defenders less time to react. Organizations should consider adopting phishing-resistant login methods (like physical security keys), closely monitor for unusual use of automated app connections and access tokens, and train employees to recognize fake error/verification messages that trick people into running malicious commands themselves.

Key Takeaways

• Business email compromise (BEC) was the most common incident type in Q2 2026 (45%), and MFA was bypassed in 100% of BEC incidents where it was implemented.
• Stolen OAuth tokens, API keys, and machine identities are increasingly abused to gain persistent access to SaaS/cloud environments without triggering re-authentication, exemplified by the Klue/Salesforce supply chain compromise.
• Phishing and social engineering (including a resurgence of ClickFix fake-CAPTCHA/paste-to-run campaigns) drove 65% of initial intrusions.
• Most frequently exploited CVEs targeted internet-facing VPN/edge appliances (Ivanti EPMM, Fortinet products, Cisco ASA, Windows Netlogon), often via authentication bypass or unauthenticated RCE.
• Dwell time is shrinking (42% of cases resolved in 3-10 days vs 23% in Q1), indicating attackers are compressing the intrusion path and reaching objectives faster, reducing defender response windows.

Affected Systems

• Ivanti Endpoint Manager Mobile (EPMM)
• Fortinet FortiAnalyzer
• Fortinet FortiWeb
• Fortinet FortiOS
• Windows Netlogon service
• Cisco ASA remote access
• Salesforce-connected SaaS integrations
• Third-party vendor/SaaS integrations (OAuth/API key dependent)
• Financial services, education & research, legal & professional services organizations
• Mid-market organizations ($1M-$100M revenue)

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Phishing/social engineering (65%), including resurgent ClickFix fake-CAPTCHA prompts, or exploitation of internet-facing VPN/edge device CVEs, or abuse of stolen OAuth tokens/API keys via third-party vendor integrations
2. Persistence: Attackers establish remote access using tools like AnyDesk and PSExec
3. Escalation: Credential stealers (e.g., Mimikatz) used to escalate privileges and move laterally
4. Data Access: Threat actors use APIs (e.g., GraphAPI) to pull data from connected platforms, bypassing MFA re-authentication via previously authorized tokens/apps
5. End Goal: Data exfiltration, extortion, business interruption, or in supply-chain cases, direct abuse of inherited machine identities to skip earlier stages entirely

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article is a quarterly trend/statistics report and does not include YARA, Sigma, Snort/Suricata, KQL, SPL, EQL, or other detection rule content; it references a downloadable full report for further detail but no rule bodies are provided in the blog text itself.

Detection Engineering Assessment

Required Log Sources

• Email gateway / M365 or Google Workspace audit logs
• Identity provider logs (Azure AD/Entra ID sign-in and OAuth consent logs)
• SaaS platform audit logs (e.g., Salesforce event monitoring)
• EDR process execution and command-line logs
• VPN/edge device authentication and administrative access logs
• Cloud API/OAuth token usage logs

Hunting Hypotheses

Control Gaps

• Traditional perimeter and network-based defenses provide limited value against attackers who already possess valid credentials or tokens.
• Standard MFA (push/OTP based) is insufficient against phishing kits capable of intercepting authenticated token responses.
• Email security controls can be bypassed entirely by ClickFix-style attacks since the victim executes the payload locally rather than via a malicious attachment or link.
• Identity governance programs that focus only on human user accounts may miss OAuth grants, API keys, and service account abuse tied to third-party integrations.

Key Behavioral Indicators

• User pasting and executing commands into Run dialog or terminal shortly after interacting with a browser-based prompt
• New or modified OAuth application consent grants with unusually broad scopes
• Remote access tool (e.g., AnyDesk, PSExec) execution by accounts/hosts with no prior history of such tool use
• Authentication events showing session/token reuse without subsequent MFA challenges over abnormal time periods
• Sudden spikes in automated API calls to SaaS platforms from service accounts or integration credentials

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate implementing phishing-resistant MFA (e.g., FIDO2 hardware keys or passkeys) where supported by your identity provider.
• Consider shortening session/token lifetimes and enforcing conditional-access policies that flag anomalous token use or impossible-travel logins.
• Evaluate continuous monitoring and inventory processes for OAuth grants, API keys, and service accounts connected to SaaS/vendor integrations, scoping them to least privilege.
• Consider network segmentation to limit lateral movement opportunities if an edge device or vendor integration is compromised.

User Protection

• Consider deploying EDR detection/alerting for command execution patterns consistent with ClickFix-style paste-and-run social engineering.
• Evaluate blocking or restricting execution of remote access tools (AnyDesk, PSExec) from unauthorized hosts or accounts if not required for business operations.
• Consider enabling detailed logging and alerting for privileged account authentication and credential access tool usage (e.g., LSASS access patterns).

Security Awareness

• Incorporate ClickFix-style fake CAPTCHA, CloudFlare verification, and copy-paste command scams into phishing/social engineering awareness training.
• Consider educating employees on recognizing and reporting unusual third-party app consent/authorization prompts.
• Evaluate reinforcing insider threat awareness and offboarding procedures, particularly around compensation/bonus cycles when employment status changes are more frequent.

MITRE ATT&CK Mapping

Additional IOCs

• Command Lines:
  • Purpose: ClickFix social engineering lures victims into pasting and executing attacker-supplied commands via fake CAPTCHA/error prompts | Tools: Windows Run dialog, clipboard-based execution | Stage: Initial Access / Execution