--- title: The Huntress Tragic Quadrant: Ranking Threats Hitting... description: Huntress Labs ranks the cyber tactics hitting businesses hardest in its 'Tragic Quadrant' report. RMM abuse involved in 45% of endpoint-related incidents... canonical: https://daily.dev/posts/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest-xfixyx2qo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest | daily.dev og:description: Huntress Labs ranks the cyber tactics hitting businesses hardest in its 'Tragic Quadrant' report. RMM abuse involved in 45% of endpoint-related incidents... og:url: https://daily.dev/posts/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest-xfixyx2qo og:image: https://api.daily.dev/og/posts/XFIXyX2qO.png og:image:alt: The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 5 min read · 0 upvotes · 0 comments ## Summary Huntress Labs ranks the cyber tactics hitting businesses hardest in its 'Tragic Quadrant' report. RMM abuse involved in 45% of endpoint-related incidents Huntress investigated in Q1 2026, while mailbox manipulation accounted for 24.6% of ITDR signals so far in 2026. Adversary-in-the-middle attacks made up 18.9% of identity-based threats Huntress tracked in 2025, stealing Microsoft 365 session tokens to bypass MFA. A phishing-as-a-service kit called EvilTokens hit 344 organizations across five countries in a 16-day window, ClickFix accounts for about 2.2% of Managed EDR signals so far in 2026 with nearly 99% high severity, and a malicious Claude Artifact used by FakeAgent reached 29 organizations in two days. This is sponsored content written by Huntress Labs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of endpoint incidents involve RMM tool abuse in 2026? Remote monitoring and management (RMM) abuse was involved in 45% of endpoint-related incidents investigated by Huntress in Q1 2026. Attackers favor RMM tools because a rogue install grants persistent access that resembles ordinary admin activity, and some campaigns now use AI-generated fake document shares to trick users into installing unwanted RMMs. _Teams prioritizing endpoint defenses can track emerging RMM abuse trends on daily.dev._ ### How does adversary-in-the-middle phishing bypass Microsoft 365 MFA? An adversary-in-the-middle (AiTM) attack sits between the victim and the real Microsoft 365 login page, stealing the session token as it passes through so the login looks normal to the user. AiTM attacks made up 18.9% of all identity-based threats tracked in 2025, and a stolen session lets an attacker in without a password or new MFA prompt. _Developers securing SSO flows can follow AiTM defense tactics on daily.dev._ ### What is the EvilTokens device code phishing kit and how many organizations did it hit? EvilTokens is a phishing-as-a-service (PhaaS) kit that abuses Microsoft's legitimate device code login flow, tricking users into entering a code that hands the attacker a long-lived access token. In a single 16-day window, EvilTokens hit 344 organizations across five countries, and 'check the URL' advice does not help since the login page is genuine. _Security teams tracking device code phishing kits like this can follow updates on daily.dev._ ## Similar posts on daily.dev - [Huntress Tragic Quadrant Rates “Pucker Factor,” Reveals RMM as Biggest Risk](https://daily.dev/posts/huntress-tragic-quadrant-rates-pucker-factor-reveals-rmm-as-biggest-risk-fr80ekfzm) · Security Boulevard · 0 upvotes · 0 comments - [Cybercrime Goes Corporate: Huntress Report Reveals Rise of Scalable, Stealth-First Attacks](https://daily.dev/posts/cybercrime-goes-corporate-huntress-report-reveals-rise-of-scalable-stealth-first-attacks-6forbf2ua) · IT Security Guru · 0 upvotes · 0 comments - [5 Modern Threats You Need to Watch](https://daily.dev/posts/5-modern-threats-you-need-to-watch-ic96ecj6o) · Huntress Blog · 0 upvotes · 0 comments - [The Top 4 Threats We Found by Investigating Every Alert for a Quarter](https://daily.dev/posts/the-top-4-threats-we-found-by-investigating-every-alert-for-a-quarter-eqaymwlmd) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#microsoft](https://daily.dev/tags/microsoft), [#ransomware](https://daily.dev/tags/ransomware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest-xfixyx2qo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest","url":"https://daily.dev/posts/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest-xfixyx2qo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest-xfixyx2qo"},"datePublished":"2026-10-27T14:09:53.042Z","dateModified":"2026-10-27T14:21:51.015Z","description":"Huntress Labs ranks the cyber tactics hitting businesses hardest in its 'Tragic Quadrant' report. RMM abuse involved in 45% of endpoint-related incidents...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8e4baf539eb828e2f30d46378c57837a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8e4baf539eb828e2f30d46378c57837a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest-xfixyx2qo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"microsoft,ransomware,phishing","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest-xfixyx2qo#faq","mainEntity":[{"@type":"Question","name":"What percentage of endpoint incidents involve RMM tool abuse in 2026?","acceptedAnswer":{"@type":"Answer","text":"Remote monitoring and management (RMM) abuse was involved in 45% of endpoint-related incidents investigated by Huntress in Q1 2026. Attackers favor RMM tools because a rogue install grants persistent access that resembles ordinary admin activity, and some campaigns now use AI-generated fake document shares to trick users into installing unwanted RMMs. Teams prioritizing endpoint defenses can track emerging RMM abuse trends on daily.dev."}},{"@type":"Question","name":"How does adversary-in-the-middle phishing bypass Microsoft 365 MFA?","acceptedAnswer":{"@type":"Answer","text":"An adversary-in-the-middle (AiTM) attack sits between the victim and the real Microsoft 365 login page, stealing the session token as it passes through so the login looks normal to the user. AiTM attacks made up 18.9% of all identity-based threats tracked in 2025, and a stolen session lets an attacker in without a password or new MFA prompt. Developers securing SSO flows can follow AiTM defense tactics on daily.dev."}},{"@type":"Question","name":"What is the EvilTokens device code phishing kit and how many organizations did it hit?","acceptedAnswer":{"@type":"Answer","text":"EvilTokens is a phishing-as-a-service (PhaaS) kit that abuses Microsoft's legitimate device code login flow, tricking users into entering a code that hands the attacker a long-lived access token. In a single 16-day window, EvilTokens hit 344 organizations across five countries, and 'check the URL' advice does not help since the login page is genuine. Security teams tracking device code phishing kits like this can follow updates on daily.dev."}}]} ```