Routine Access Is Powering Modern Intrusions, a New Threat Report Finds

Blackpoint Cyber's 2026 Annual Threat Report analyzes thousands of 2025 investigations and finds attackers increasingly rely on legitimate access paths—SSL VPN abuse (32.8%), RMM abuse (30.3%, often ScreenConnect), social-engineering campaigns (57.5% fake CAPTCHA/ClickFix), and MFA session reuse via adversary-in-the-middle phishing (≈16%)—and documents a new WebSocket-based implant called Roadk1ll; the report emphasizes treating remote access as high-risk and improving inventory, access controls, and conditional access policies.