What's Trending: Top Cyber Attacker Techniques, March - May 2026

**Executive summary:** Between March 1 and May 31, 2026, attackers relied on behavior‑based tradecraft—especially the ClickFix social‑engineering delivery (now seen on macOS via the Atomic macOS Stealer), removable‑media worms (Gamarue, Raspberry Robin), and a converging ransomware playbook (led by Qilin) that exploits unpatched internet‑facing appliances, Cloudflared tunnels, and single‑host SMB encryption—so defenders should prioritize behavior detection, patching/hardening edge devices, and monitoring for rogue tunnels and bulk SMB writes.