Q3 2026 Attack Techniques Trend Report

In Q3 2026 attackers increasingly exploited perimeter device vulnerabilities (e.g., NetScaler CVEs, Cisco FMC CVEs) to deploy web shells and escalate privileges, distributed malicious package versions through npm/PyPI and tampered build/publish workflows to achieve supply-chain compromise, and conducted identity attacks (passkey abuse, AiTM phishing, token theft) to gain access to Microsoft and Okta resources. The report maps observed techniques to MITRE ATT&CK, quantifies a rise in KEV listings, and recommends urgent patching, CI/CD and credential hygiene, session and token revocation, and phishing-resistant authentication.