LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses

**Executive summary:** LevelBlue's Q2 2026 TTP Briefing reports that identity-based attacks (BEC, stolen OAuth tokens/API keys, valid credential abuse) and software supply chain compromises drove a majority of incidents, MFA was bypassed in all BEC cases observed, attackers increasingly exploit internet-facing edge/VPN appliance CVEs, dwell time shortened as adversaries compress the intrusion path, and notable campaigns (Klue, ClickFix, Shai-Hulud) and actor identifiers were documented along with detection and mitigation guidance.