IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

Cisco Talos quarterly incident response summary: phishing (including QR-code PDF lures) and authentication abuse (65% of engagements) drove most compromises, with credential-harvesting campaigns (actor UAT-11764) and a PhaaS platform (ARToken) enabling OAuth/device-code and token-based bypasses. Ransomware incidents (>20% of engagements) included Sinobi using a trojanized MeshAgent and Warlock deploying Zoho Assist, highlighting abuse of legitimate admin tools; the report maps observed TTPs to MITRE ATT&CK and recommends phishing-resistant MFA, centralized logging, patching, and behavior-based detection.