Cyber headlines often focus on the flashy attacks, but the ones that actually cause OH $#!T moments are the tactics that abuse the tools and workflows you already trust. If you run a small or mid-sized organization, whether you handle IT yourself or outsource it, it’s a constant race to keep up with attackers and their evolving tactics.
The bottom line is that you need to know which attacks are landing in environments like yours, and how to prioritize your defenses against them.
That’s why Huntress created the Tragic Quadrant, a ranked list of the cyber tactics putting businesses at risk, built to show you where to focus regardless of what’s trending week to week.
Each of these tactics hides inside something your team uses every day, like a remote access tool or a Microsoft 365 login.
Remote monitoring and management (RMM) tools are a staple for IT teams, which is exactly why attackers abuse them. One rogue RMM install gives an attacker persistent access that looks like ordinary admin work.
In Q1 2026, 45% of endpoint-related incidents Huntress investigated involved RMM abuse. Attackers are also using AI to build convincing fake document shares and service agreement lures that trick users into installing unwanted RMMs.
So far in 2026, 24.6% of Identity Threat Detection and Response (ITDR) signals point to mailbox manipulation and persistence. With mailbox access, an attacker can change inbox rules and send vendor replies to folders nobody is watching, like RSS Feeds or Archive.
From there, they can tweak invoice details and redirect payments to their own accounts, all without any malware for detection tools to flag.
Adversary-in-the-middle (AiTM) attacks made up 18.9% of all identity-based threats Huntress tracked in 2025. The attacker sits between the victim and the real Microsoft 365 login page, steals the session token in transit, and forwards everything along so nothing looks off to the user.
As long as that session is valid, the attacker can access the account without a password or a fresh MFA prompt.
Your files are encrypted, your operations are down, an attacker has named their price, and they’re waiting for you to respond. Do you pay? Do you negotiate? Do you even engage at all?
Choose your next move in a simulated ransomware incident, built from tactics Huntress has seen used against real businesses. You’ll see how ransomware operators behave when they think they’re in control, and what steps you can take for catching an attack before it becomes a negotiation.
Once you’ve covered the top-right tactics, the others still deserve a plan. Each one is evolving fast, potentially moving toward the OH $#!T corner at any time.
Device code phishing is less common, but it rides on Microsoft’s real device code login flow, so “check the URL” advice doesn’t help. A convincing prompt nudges someone to enter a short code on a genuine Microsoft page, and the attacker walks away with an access token that can outlive a password reset.
In one 16-day window, a phishing-as-a-service (PhaaS) kit called EvilTokens hit 344 organizations across five countries. Defenders should be suspicious of unusual device code prompts and odd token activity.
ClickFix leans on the copy-paste muscle memory people use to get past everyday friction. A fake CAPTCHA or “verification failed” prompt tricks someone into pasting a malicious command into their terminal. The paste itself triggers the malicious code, so no exploit chain is involved, and it can lead to infostealer malware or ransomware.
ClickFix accounts for about 2.2% of Managed Endpoint Detection and Response (EDR) detection signals so far in 2026, but nearly 99% of those detections are high severity.
This one sits in the overhyped corner because it’s still an emerging pattern. Attackers hide malicious content behind real AI tools and workflows people trust.
A fake “desktop client” or “productivity helper” might live inside a shared conversation or a hosted artifact on a trusted AI domain like Claude or ChatGPT, which makes it tricky to tell what’s malicious.
In one case, FakeAgent used a malicious Claude Artifact on the real claude.ai domain to send people looking for Claude Desktop to SectopRAT, reaching 29 organizations in two days.
The Tragic Quadrant helps you pick what to fix first when everything feels urgent.
Start in the top right corner and ask a few simple questions: Which remote tools are approved, and how do we catch mailbox rule changes and odd session behavior before they turn into something worse?
Grab your copy of the Huntress Tragic Quadrant to work through every corner on your own timeline and decide which gaps to close next
Critical ‘HTTP2Shell’ Brotli vulnerability triggers emergency patches
Microsoft releases emergency .NET patches for critical Brotli flaw
PHP2Shell security flaws now sucessfully exploited in the wild
Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.
What can your AI agents actually do? Learn to control every action in our Nov. 18 webinar.
CTA: Hijacked sessions reach every app your users touch. See how Exaforce agents contain identity attacks
Who really has control of your AI agent? Gen is taking on the agent trust problem.
Get your free 30-day browser security assessment
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
