The Huntress Tragic Quadrant: Beat the Hype on Cyber Tactics Wrecking Businesses
Huntress ranks RMM abuse, mailbox manipulation, and AiTM phishing as the most prevalent and dangerous threats to SMBs, with AI-accelerated lures increasing effectiveness across all attack vectors. RMM tool abuse appeared in 45% of endpoint incidents in Q1 2026, enabling persistent access disguised as admin activity. Mailbox manipulation drives 24.6% of identity threats, enabling BEC via hidden inbox rules. Device code phishing and AI platform abuse represent emerging vectors that bypass traditional security by abusing trusted workflows and legitimate infrastructure.
Detection / Hunteropenrouter
Immediate Actions
- Audit all installed RMM tools and establish an approved list
- Review mailbox rules for unauthorized forwarding or hiding
- Block session token reuse from anomalous IP ranges via conditional access
- Monitor Azure AD device code flow logs for unusual completions
Key Takeaways
- 45% of endpoint incidents in Q1 2026 involved rogue RMM tool installation
- EvilTokens PhaaS hit 344 organizations across 5 countries in 16 days
- ClickFix accounts for 2.2% of EDR signals but nearly 99% are high severity
- FakeAgent delivered SectopRAT via Claude Artifact to 29 orgs in 2 days
- AiTM attacks represented 18.9% of identity-based threats tracked in 2025
Attack Chain
- Initial Access: AI-enhanced phishing lures deliver fake document shares, CAPTCHA prompts, or device code requests
- Execution: Victims install rogue RMM tools, paste malicious commands into Run dialog, or authorize device codes
- Persistence: Attackers maintain access through RMM tools or hidden mailbox inbox rules routing to Archive folders
- Defense Evasion: Legitimate platforms (Railway, Claude, Cisco redirects) host infrastructure to bypass security filters
- Credential Access: AiTM phishing intercepts session tokens to bypass MFA and access Microsoft 365 accounts
- Impact: BEC fraud, data theft, or ransomware deployment via established persistent access
Affected Systems
- Windows endpoints with Run dialog access
- Microsoft 365 mailboxes and identities
- Remote monitoring and management (RMM) tool deployments
- AI platforms (Claude, ChatGPT, Grok) with public artifacts
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | RMM installs and Run box execution are visible; mailbox rule changes occur cloud-side. |
| Network Visibility | Low | Traffic to legitimate platforms like Microsoft and Claude blends with normal activity. |
| Detection Difficulty | Hard | Attacks abuse legitimate tools and trusted platforms, requiring behavioral baselines to distinguish from admin activity. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| RMM tool binaries installed by non-standard processes or outside change windows indicate attacker persistence (T1218, T1547). | Process creation and software install logs | Persistence | Medium — IT teams legitimately deploy RMM tools |
| New mailbox inbox rules routing email to Archive or RSS folders indicate BEC persistence (T1098.002). | Exchange admin audit logs | Persistence | Low — auto-routing to hidden folders is uncommon |
| Device code authentication flows completed from non-corporate networks indicate phishing-based token theft (T1528). | Azure AD sign-in and conditional access logs | Credential Access | Medium — legitimate device code flows exist |
| Process execution from Run dialog with clipboard-pasted content indicates ClickFix social engineering (T1059, T1204.002). | EDR process creation with parent explorer.exe | Execution | Low — rare in managed enterprise environments |
Required Log Sources
- Azure AD sign-in logs
- Exchange admin audit logs
- EDR process creation events
- Software installation events
- DNS resolution logs
- Proxy or web gateway logs
Key Behavioral Indicators
- New RMM tool binaries on endpoints outside approved software list
- Inbox rules creating hidden folders or routing to Archive
- Session tokens used from IPs outside user typical geography
- Device code flow completions from non-corporate networks
- Process chain: explorer.exe to Run dialog to scripting engine
- Typosquat domains mimicking legitimate AI platform URLs
Control Gaps
- Traditional URL filtering misses legitimate domain abuse
- MFA does not prevent AiTM session token theft
- Mailbox rule monitoring absent in most SMB environments
- Malware signatures ineffective against device code phishing
- RMM tool approval processes often missing or unenforced
False Positive Assessment
Medium — RMM tool usage and mailbox rule creation are legitimate admin activities requiring behavioral context to distinguish malicious use.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enforce conditional access policies restricting session token lifetime
- Implement Exchange transport rules alerting on new inbox rules
- Block typosquat domains mimicking legitimate AI platforms
- Restrict outbound traffic to non-approved RMM tool endpoints
User Protection
- Deploy EDR with behavioral detection on all endpoints
- Train staff on ClickFix social engineering and fake CAPTCHA prompts
- Warn users about device code phishing via Microsoft login flows
- Disable Win+R Run dialog for non-admin users where feasible
Security Awareness
- Train employees to verify RMM installation requests via phone callback
- Educate finance teams on BEC red flags and invoice verification procedures
- Brief staff on AI platform phishing using trusted domains
MITRE ATT&CK Mapping
Initial Access
Persistence
Stealth
Credential Access
Lateral Movement
Impact
Plain-Language Summary
Huntress analyzed threats across 5 million endpoints and 300,000 organizations to identify which attacks most disrupt small and mid-sized businesses. The most dangerous threats abuse trusted IT tools like remote management software and email systems rather than using novel malware. Organizations should audit approved tool lists, monitor mailbox rules for unauthorized changes, and train staff on social engineering tactics that bypass traditional security checks.
Additional IOCs
- Command Lines:
- Purpose: Execute clipboard-pasted malicious payload via Windows Run dialog | Tools:
explorer.exe,Run dialog| Stage: Execution |Win+R then Ctrl+V then Enter
- Purpose: Execute clipboard-pasted malicious payload via Windows Run dialog | Tools:
- urlhxxps://claude[.]ai[.]download-app[.]usFakeAgent typosquat phishing URL delivering SectopRAT