Talos: Attackers Refine Phishing Playbook To Target Critical Infrastructure

Cisco Talos' Q2 2026 Incident Response Trends report warns of a sharp increase in phishing (over 50% of engagements) and authentication abuse (65% of engagements), with healthcare, public administration and manufacturing heavily targeted; attackers are using advanced phishing techniques (QR-code embedded PDFs, compromised Microsoft 365/SharePoint, OAuth device-flow abuse), MFA bypass methods, and legitimate cloud/remote-management tools to evade defenses and deploy ransomware and other follow-on activity. Organizations are advised to adopt phishing-resistant MFA, reduce public exposure, improve logging and patch management to mitigate these risks.