Huntress ranks RMM abuse and mailbox attacks atop SMB threats
Original title: The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
Huntress says RMM abuse was 45% of Q1 2026 endpoint incidents and mailbox manipulation 24.6% of 2026 ITDR signals.
Huntress published a sponsored Tragic Quadrant ranking tactics it says hurt small and mid-sized businesses most. Remote-monitoring-tool abuse, mailbox-rule changes used for payment fraud, and adversary-in-the-middle theft of Microsoft 365 sessions sit in its top corner. It also describes device-code phishing with the EvilTokens kit, ClickFix prompts that lead users to paste commands, and FakeAgent abuse of a Claude Artifact to spread SectopRAT. The piece directs readers to Huntress's quadrant and a ransomware simulator.
Unconfirmed: The percentages are Huntress's own telemetry, and the ranking is sponsored content.
- AiTM attacks were 18.9% of identity threats Huntress tracked in 2025.
- EvilTokens hit 344 organizations in five countries during a 16-day window.
- ClickFix is about 2.2% of 2026 EDR signals, nearly 99% high severity.
- FakeAgent on claude.ai reached 29 organizations in two days, Huntress says.
- ATT&CK
- T1219 Remote Access SoftwareT1557 Adversary-in-the-MiddleT1059 Command and Scripting Interpreter
- Vendors
- Microsoft
- Products
- Microsoft 365
- Malware
- EvilTokensSectopRATFakeAgent
- Organizations
- Huntress
- AI models
- Claude
From the original article
4 min read at bleepingcomputer.com
Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and which remain emerging risks. [...]
By Sponsored by Huntress Labs · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.