Cyberattacks that misuse trusted tools and familiar workflows can be especially disruptive for small and medium-sized organizations. Huntress’ Tragic Quadrant highlights the tactics currently posing the greatest risk—from remote monitoring and management (RMM) abuse and mailbox manipulation to adversary-in-the-middle attacks—while also tracking emerging threats such as device code phishing, ClickFix and malicious content hosted through legitimate AI platforms.
Organizations that manage IT internally or rely on an outside provider must understand which attack methods are targeting environments like theirs and determine where defensive improvements are most urgent.
Huntress’ Tragic Quadrant
The Huntress Tragic Quadrant is a ranked overview of cyberattack tactics that put businesses at risk. It is designed to help organizations prioritize security efforts beyond short-lived weekly trends.
Prioritize these threats first: the OH $#!T corner
These tactics are concealed within services and workflows that employees and IT teams use every day, including remote access tools and Microsoft 365 accounts.
RMM abuse remains a major threat
Remote monitoring and management (RMM) tools are essential to many IT teams, making them attractive targets for attackers. By installing an unauthorized RMM tool, an attacker can maintain access while carrying out actions that appear to be routine administrative work.
During the first quarter of 2026, 45% of endpoint-related incidents investigated by Huntress involved RMM abuse. Attackers are also using artificial intelligence to create convincing fake document shares and lures designed to persuade users to sign up for services. Organizations should avoid installing unnecessary RMM tools.
Mailbox manipulation can enable business email compromise
So far in 2026, mailbox manipulation and persistence have accounted for 24.6% of Identity Threat Detection and Response (ITDR) signals. After compromising a mailbox, an attacker can modify inbox rules and redirect vendor replies to locations that users rarely monitor, including RSS feeds or archive folders.
Attackers can then alter billing details or redirect payments to their own accounts without triggering malware detections.
Account takeover can bypass MFA
Man-in-the-middle (AiTM) attacks represented 18.9% of all identity-based threats tracked by Huntress in 2025. In these attacks, the criminal positions a phishing site between the victim and the genuine Microsoft 365 login page, steals session tokens during the exchange and transparently passes the transaction to the user.
While the session remains valid, the attacker can access the account without entering the password again or triggering another multifactor authentication prompt.
The files are encrypted, the operation is stopped, and the attacker names a price while waiting for your response. Should you pay, negotiate or take another approach?
Choose your next move in a simulated ransomware incident based on tactics Huntress has observed against real companies. The exercise demonstrates how ransomware operators act when they believe they are in control and what steps can help detect an attack before it escalates into negotiations.
The remaining three corners
After addressing the most urgent tactics, organizations should plan for the remaining threats. Each is evolving quickly and could move into the OH $#!T corner at any time.
Device code phishing creates a quieter risk
Device code phishing makes advice such as “verify the URL” less effective because it abuses Microsoft’s legitimate device code login flow. A convincing prompt persuades the victim to enter a short code on a genuine Microsoft page, allowing the attacker to obtain an access token that can remain valid even after a password reset.
Over a period of 16 days, a phishing-as-a-service (PhaaS) kit called EvilTokens targeted 344 organizations in five countries. Defenders should investigate unusual device code prompts and unexpected token activity.
ClickFix exploits everyday copy-and-paste habits
ClickFix takes advantage of the copy-and-paste actions people use to resolve routine technical problems. A fake CAPTCHA or “Verification Failed” message can persuade a user to paste malicious commands into a terminal. The pasted command itself launches the attack, without requiring an exploit chain, and can deliver information-stealing malware or ransomware.
ClickFix represented approximately 2.2% of managed endpoint detection and response (EDR) detection signals so far in 2026. Nearly 99% of those detections were classified as high severity.
AI platform exploitation remains overhyped
Because this is still an emerging pattern, it sits in the overvalued corner of the quadrant. Attackers are hiding malicious content inside legitimate AI tools and workflows that users already trust.
Fake “desktop clients” and “productivity helpers” can appear in shared conversations or hosted artifacts on trusted AI domains such as Claude or ChatGPT, making malicious content harder to identify.
In one incident, FakeAgent used a malicious Claude artifact hosted on the legitimate claude.ai domain to target users searching for the Claude desktop application. SectopRAT reached 29 organizations in two days.
How to use the Tragic Quadrant
The Tragic Quadrant is intended to help organizations decide what to address first when every security issue seems urgent.
Start with the top-right corner and ask which remote tools are approved, how unauthorized tools are detected, and whether mailbox-rule changes or unusual session behavior can be identified before an incident escalates.
Get a copy of the Huntress Tragic Quadrant and work through each corner to determine which security gaps to address next.
Sponsored and written by Huntress Institute.
Source: www.bleepingcomputer.com