--- title: RMM abuse behind 45% of endpoint incidents as Huntress... description: Huntress published its first Tragic Quadrant report, ranking cyber tactics its SOC detects most often against how severe the damage is once they land. Based on... canonical: https://daily.dev/posts/rmm-abuse-behind-45-of-endpoint-incidents-as-huntress-publishes-inaugural-tragic-quadrant-llpmm7lkl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: RMM abuse behind 45% of endpoint incidents as Huntress publishes inaugural Tragic Quadrant | daily.dev og:description: Huntress published its first Tragic Quadrant report, ranking cyber tactics its SOC detects most often against how severe the damage is once they land. Based on... og:url: https://daily.dev/posts/rmm-abuse-behind-45-of-endpoint-incidents-as-huntress-publishes-inaugural-tragic-quadrant-llpmm7lkl og:image: https://api.daily.dev/og/posts/llPMM7lKL.png og:image:alt: RMM abuse behind 45% of endpoint incidents as Huntress publishes inaugural Tragic Quadrant og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # RMM abuse behind 45% of endpoint incidents as Huntress publishes inaugural Tragic Quadrant **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 4 min read · 0 upvotes · 0 comments ## Summary Huntress published its first Tragic Quadrant report, ranking cyber tactics its SOC detects most often against how severe the damage is once they land. Based on telemetry from over 5 million endpoints and 15 million identities across nearly 300,000 organisations, the report finds that 45% of endpoint incidents in Q1 2026 involved abuse of legitimate remote monitoring and management (RMM) tools, up 277% year over year. Mailbox manipulation (24.6% of ITDR signals) and adversary-in-the-middle account takeover (18.9% of identity threats) round out the top-risk corner. About 70% of intrusions start via VPN logins with valid credentials and no MFA. Low-frequency but high-severity tactics include ClickFix fake-CAPTCHA attacks (2.2% of signals, 99% high severity, 53.2% of loader activity), device code phishing (up 1,380%), a phishing kit called EvilTokens hitting 344 orgs in 16 days, and BYOVD EDR killers like Throttlestop/RWDriver. Attackers also weaponised flaws in Wing FTP Server, WSUS, and Gladinet CentreStack/Triofox within days of disclosure. Huntress recommends auditing approved RMM tools, baselining inbox rules, shortening session lifetimes, and eliminating password-only remote access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of endpoint incidents involve abuse of RMM tools according to Huntress data? 45% of endpoint-related incidents investigated by Huntress in Q1 2026 involved abuse of remote monitoring and management (RMM) tools, making it the single most common threat category on endpoints. RMM abuse rose 277% year over year in 2025, since attackers can use legitimate, already-trusted tools instead of building custom malware. _Security teams auditing which remote access tools touch their endpoints can follow ongoing coverage of RMM abuse trends on daily.dev._ ### How severe is the ClickFix fake CAPTCHA phishing technique compared to other attack methods? ClickFix made up only 2.2% of suspicious EDR detection signals but nearly 99% of those signals were rated high severity, and it was behind 53.2% of all malware loader activity in 2025. It works by tricking users into pasting malicious commands into the Windows Run box via a fake CAPTCHA prompt. _Defenders tracking emerging phishing techniques like ClickFix can keep up with analysis on daily.dev._ ### What portion of intrusions detected by Huntress start through VPN access with stolen credentials? Roughly 70% of active intrusions caught by the Huntress SOC start with adversaries authenticating through VPN access, often using valid credentials and no second factor. Exposed remote access protocols like RDP are frequently targeted once internet-facing, underscoring the need to eliminate password-only authentication paths. _Teams hardening VPN and remote access policies can follow practical identity-security guidance on daily.dev._ ## Similar posts on daily.dev - [Huntress Tragic Quadrant Rates “Pucker Factor,” Reveals RMM as Biggest Risk](https://daily.dev/posts/huntress-tragic-quadrant-rates-pucker-factor-reveals-rmm-as-biggest-risk-fr80ekfzm) · Security Boulevard · 0 upvotes · 0 comments - [RMM Abuse: How Attackers Exploit Remote Access Tools](https://daily.dev/posts/rmm-abuse-how-attackers-exploit-remote-access-tools-kmwmtlqwz) · Huntress Blog · 0 upvotes · 0 comments - [RMM Abuse Explodes as Hackers Ditch Malware](https://daily.dev/posts/rmm-abuse-explodes-as-hackers-ditch-malware-v44l6tyt4) · Dark Reading · 0 upvotes · 0 comments - [Routine Access Is Powering Modern Intrusions, a New Threat Report Finds](https://daily.dev/posts/routine-access-is-powering-modern-intrusions-a-new-threat-report-finds-id7ymbim2) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/rmm-abuse-behind-45-of-endpoint-incidents-as-huntress-publishes-inaugural-tragic-quadrant-llpmm7lkl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"RMM abuse behind 45% of endpoint incidents as Huntress publishes inaugural Tragic Quadrant","url":"https://daily.dev/posts/rmm-abuse-behind-45-of-endpoint-incidents-as-huntress-publishes-inaugural-tragic-quadrant-llpmm7lkl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rmm-abuse-behind-45-of-endpoint-incidents-as-huntress-publishes-inaugural-tragic-quadrant-llpmm7lkl"},"datePublished":"2026-10-01T15:08:32.491Z","dateModified":"2026-10-15T02:22:45.607Z","description":"Huntress published its first Tragic Quadrant report, ranking cyber tactics its SOC detects most often against how severe the damage is once they land. Based on...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bfdfe4d05192e08699814de8d19c52d9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bfdfe4d05192e08699814de8d19c52d9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rmm-abuse-behind-45-of-endpoint-incidents-as-huntress-publishes-inaugural-tragic-quadrant-llpmm7lkl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,phishing","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"RMM abuse behind 45% of endpoint incidents as Huntress publishes inaugural Tragic Quadrant"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rmm-abuse-behind-45-of-endpoint-incidents-as-huntress-publishes-inaugural-tragic-quadrant-llpmm7lkl#faq","mainEntity":[{"@type":"Question","name":"What percentage of endpoint incidents involve abuse of RMM tools according to Huntress data?","acceptedAnswer":{"@type":"Answer","text":"45% of endpoint-related incidents investigated by Huntress in Q1 2026 involved abuse of remote monitoring and management (RMM) tools, making it the single most common threat category on endpoints. RMM abuse rose 277% year over year in 2025, since attackers can use legitimate, already-trusted tools instead of building custom malware. Security teams auditing which remote access tools touch their endpoints can follow ongoing coverage of RMM abuse trends on daily.dev."}},{"@type":"Question","name":"How severe is the ClickFix fake CAPTCHA phishing technique compared to other attack methods?","acceptedAnswer":{"@type":"Answer","text":"ClickFix made up only 2.2% of suspicious EDR detection signals but nearly 99% of those signals were rated high severity, and it was behind 53.2% of all malware loader activity in 2025. It works by tricking users into pasting malicious commands into the Windows Run box via a fake CAPTCHA prompt. Defenders tracking emerging phishing techniques like ClickFix can keep up with analysis on daily.dev."}},{"@type":"Question","name":"What portion of intrusions detected by Huntress start through VPN access with stolen credentials?","acceptedAnswer":{"@type":"Answer","text":"Roughly 70% of active intrusions caught by the Huntress SOC start with adversaries authenticating through VPN access, often using valid credentials and no second factor. Exposed remote access protocols like RDP are frequently targeted once internet-facing, underscoring the need to eliminate password-only authentication paths. Teams hardening VPN and remote access policies can follow practical identity-security guidance on daily.dev."}}]} ```