Why Trust is the New Attack Surface: Mid-Year Threat Update 2026

MITRE Techniques

• [T1566 ] Phishing – Used to deliver trusted-looking malicious messages and social engineering, including high-volume text and novel techniques (‘phishing emails passed DMARC’ and ‘novel social engineering techniques’).
• [T1204 ] User Execution – ClickFix tricks users into running malicious code themselves (‘tricks users into running malicious code themselves’).
• [T1056.001 ] Input Capture: Keylogging – Infostealers harvested credentials and other identity material for later intrusion paths (‘Credentials harvested by infostealers often become the initial access vector’).
• [T1078 ] Valid Accounts – Attackers inherited trust by abusing compromised SaaS accounts, delegated access, and legitimate administration tools (‘they inherit them through compromised identities, delegated access, and legitimate administration tools’).
• [T1195 ] Supply Chain Compromise – Used against Axios, Trivy, and Hola VPN delivery paths to push malicious code or payloads (‘trusted CI/CD infrastructure’ and ‘issue within Hola’s own delivery pipeline’).
• [T1105 ] Ingress Tool Transfer – Malicious payloads were downloaded through trusted services and delivery pipelines (‘devices downloaded malicious payloads’).
• [T1219 ] Remote Access Software – RMM and remote administration tooling were repeatedly abused for control and persistence (‘remote management tooling’ and ‘RMM abuse’).
• [T1027 ] Obfuscated Files or Information – The article notes stealthy intrusions and use of malicious code packages, including AI-generated malware and trojanized installers (‘AI-generated malware’ and ‘trojanized installers’).
• [T1490 ] Inhibit System Recovery – Ransomware operations were part of the observed activity in multiple monthly clusters (‘ransomware’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell was part of June activity tied to post-compromise operations (‘PowerShell’).
• [T1486 ] Data Encrypted for Impact – Ransomware activity linked to automation and LLM-driven attacks points to encryption for impact (‘fully automated ransomware attack’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – WebSocket C2 was explicitly mentioned in January activity (‘WebSocket C2’).
• [T1095 ] Non-Application Layer Protocol – C2 and infrastructure abuse included nonstandard channels and botnet activity (‘WebSocket C2’ and ‘botnet activity’).
• [T1110 ] Brute Force – Account creation abuse, credential abuse, and authentication-focused attacks indicate repeated attempts to gain access (‘account creation abuse’ and ‘VPN credential abuse’).
• [T1021.001 ] Remote Services: Remote Desktop Protocol – RDP abuse was specifically noted in June (‘RDP abuse’).
• [T1041 ] Exfiltration Over C2 Channel – Data theft and exfiltration were part of the observed attacker behavior (‘data exfiltration’ and ‘cloud data theft’).
• [T1068 ] Exploitation for Privilege Escalation – BeyondTrust and Fortinet exploitation show rapid use of vulnerabilities for access (‘BeyondTrust exploitation’ and ‘Fortinet exploitation’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Automation frameworks and malicious workflows imply scheduled or automated execution at scale (‘automation frameworks’).
• [T1090 ] Proxy – Legitimate services and proxies were used to mask attacker infrastructure and reach victims (‘legitimate command-and-control (C2) infrastructure’).