TLDR Tech / InfoSec
Phishing Dominates as Initial Entry Method for Cyber-Attacks, as Hackers Hone Evasion Techniques
Cisco Talos's Incident Response Trends report for Q2 2026 found phishing accounted for just over half of investigated initial access incidents, up from a third the prior quarter, with threat actor UAT-11764 running a persistent campaign that uses victim-tailored PDFs containing QR codes to evade email gateway scanning and direct targets to credential harvesting pages hosted on trusted platforms like Microsoft 365 and SharePoint. Once compromised, accounts were used to create defense-evading inbox rules and propagate further phishing, while separately observed phishing-as-a-service kits now offer OAuth device-flow MFA bypass, Primary Refresh Token persistence, and encrypted anti-analysis payloads. Defenders are advised to enforce phishing-resistant MFA, block or flag QR codes in PDF attachments, monitor for suspicious inbox rule creation and SharePoint file staging, and tighten outbound email thresholds to limit lateral propagation.
Read the full story