CyberheistNews Vol 16 #35 [New Report] Phishing Is Still the No. 1 Initial Threat Access Vector

Phishing remains the dominant initial access vector in Q2 2026—attackers increasingly use QR-code PDFs and cloud-hosted links to harvest Microsoft 365 credentials and leverage compromised accounts for lateral propagation and defense evasion; MFA abuse (AitM, session-token theft, MFA fatigue, self-enrolled devices) surged. Separately, Group-IB documents WindRelay, an Android RAT distributed via vishing that enabled remote fraud and NFC relay malware, and reports describe Balonx, an AI-driven phishing-as-a-service kit automating vishing at scale—together these trends highlight escalating, rapidly scalable social-engineering and credential-theft threats to organizations and individuals.