The Top 4 Threats We Found by Investigating Every Alert for a Quarter
Prophet Security's quarterly threat report finds identity attacks made up roughly half of confirmed malicious activity, with stolen authenticated sessions bypassing conditional access controls.
Between May 1 and July 31, 2026, Prophet Security investigated every alert in customer environments immediately on arrival; about 7% of completed investigations were confirmed malicious. Direct account/session attacks made up roughly 18% of confirmed activity, with replayed authenticated sessions bypassing conditional access since no re-authentication occurs. Infostealer activity affected about a quarter of investigated organizations, mostly delivered via browsers through compromised websites, malicious ads, sponsored search results and ClickFix fake CAPTCHA gates, with payloads including Lumma Stealer, Vidar, HijackLoader and AsyncRAT. Credential phishing was the largest category at about 28%, with adversary-in-the-middle relays revealed by seconds-long MFA approvals from distant countries and MFA fatigue attacks exploiting automatic unlock policies.
- Stolen authenticated session cookies bypass conditional access, survive password resets and enabled weeks of persistent email access
- Infostealers were delivered mainly via compromised sites, malicious ads and fake update prompts, not email
- Credential phishing was the largest confirmed category at about 28% of malicious activity
- Payloads included Lumma Stealer, Vidar, HijackLoader and AsyncRAT; SocGholish persists despite Operation Endgame disruption
- MFA fatigue and push bombing succeeded where automatic unlock policies allowed new device registration
- ATT&CK
- T1550.004 Web Session CookieT1539 Steal Web Session CookieT1566.002 Spearphishing LinkT1621 Multi-Factor Authentication Request GenerationT1189 Drive-by Compromise
- Vendors
- Prophet SecurityMicrosoft
- Products
- Microsoft 365
- Threat actors
- SocGholishClearFake
- Organizations
- Prophet Security
- Countries
- United States
From the original article
8 min read at bleepingcomputer.com
Identity was the target in roughly half of all confirmed malicious activity. Prophet Security breaks down the four main attack patterns seen across customer environments between May and July 2026, and explains why some attacks succeeded while others were blocked. [...]
By Sponsored by Prophet Security · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.