Threat actors are increasingly exploiting established IT instruments, Microsoft 365 sessions, and routine operational flows to compromise entities without triggering conventional security measures. Huntress Labs has developed the Tragic Quadrant, a ranked catalog of cyber tactics that pose the greatest risk to businesses, indicating where immediate defensive focus is required versus emerging dangers.
The most impactful intrusions often involve the misuse of trusted tools and workflows rather than highly visible attacks. For organizations of small or medium scale, whether internal IT manages operations or external providers do, there is a continuous effort to counter evolving attacker methodologies. Therefore, understanding which attacks target environments like yours and how to prioritize countermeasures is crucial.
Remote monitoring and management (RMM) tools, which are standard for IT departments, are frequently abused by adversaries. In Q1 2026, 45% of endpoint-related incidents investigated by Huntress involved RMM abuse, as a single compromised RMM installation can grant persistent access mimicking standard administrative activity. Furthermore, attackers are leveraging AI to create convincing lures, such as fake document shares or service agreement requests, designed to prompt users into installing unwanted RMM software.
In 2026 alone, 24.6% of Identity Threat Detection and Response (ITDR) signals have pointed toward mailbox manipulation and persistence. With access to a mailbox, an attacker can alter inbox rules and send vendor responses to unmonitored folders, like RSS Feeds or Archive. This allows them to adjust invoice specifics and reroute payments to their own accounts without any malware for detection systems to flag.
Adversary-in-the-middle (AiTM) attacks constituted 18.9% of all identity-based threats tracked by Huntress in 2025. In such an attack, the adversary positions itself between the target and the legitimate Microsoft 365 login page, capturing the session token during transit and forwarding traffic, thus appearing normal to the user. As long as the session remains valid, the attacker can access the account without needing a password or a new MFA prompt.
Device code phishing exploits Microsoft's genuine device code login flow; thus, merely advising users to "check the URL" is insufficient. A convincing prompt encourages the user to enter a short code on a legitimate Microsoft page, granting the attacker an access token that can persist beyond a password reset. For instance, a phishing-as-a-service (PhaaS) kit named EvilTokens affected 344 organizations across five countries within a 16-day period.
ClickFix leverages the ingrained habit of copying and pasting to bypass routine friction. A deceptive CAPTCHA or a "verification failed" message tricks a user into pasting a malicious command into their terminal. This paste itself initiates the malicious code, bypassing the need for an exploit chain and potentially leading to ransomware or infostealer malware. Although ClickFix accounts for approximately 2.2% of Managed Endpoint Detection and Response (EDR) signals in 2026, nearly 99% of those detections are classified as high severity, placing it in a category of emerging patterns.
Malicious content can be concealed within legitimate AI tools and workflows trusted by personnel. A fraudulent "productivity helper" or "desktop client" might reside inside a shared conversation or a hosted artifact on a trusted AI domain, such as Claude or ChatGPT, complicating detection. One documented instance involved FakeAgent utilizing a malicious Claude Artifact on the genuine claude.ai domain to redirect users seeking Claude Desktop to SectopRAT, affecting 29 organizations over two days.
The Tragic Quadrant assists decision-makers in prioritizing remediation efforts when all risks appear critical. The guidance suggests beginning with the top-right quadrant by addressing questions such as: Which remote tools are approved, and how can we detect mailbox rule changes and unusual session behavior before escalation?
This focus on abusing established workflows underscores a broader trend where security defenses must evolve to counter threats that embed themselves within the operational fabric of enterprise infrastructure. Market participants and institutions must recognize that the sophistication of these attacks demands a shift from solely blocking external intrusions to monitoring internal behavioral anomalies within trusted platforms.
