Huntress ranks top SMB threats: RMM abuse, mailbox manipulation, AiTM, device code phishing, ClickFix and AI platform abuse
Sponsored Huntress Labs content introduces the "Tragic Quadrant", a ranked view of tactics hitting small and mid-sized organizations, built on Huntress telemetry. The highest-priority tactics are those that abuse trusted tools: RMM abuse (45% of endpoint incidents investigated in Q1 2026), mailbox manipulation for BEC (24.6% of ITDR signals in 2026) and adversary-in-the-middle (AiTM) account takeover (18.9% of identity threats in 2025). Lower-priority but fast-evolving tactics are device code phishing, ClickFix and AI platform abuse. The article cites the EvilTokens PhaaS kit hitting 344 organizations in five countries in 16 days, and the FakeAgent campaign abusing a malicious Claude Artifact on claude.ai to deliver SectopRAT to 29 organizations in two days. The figures are vendor-reported and the piece is promotional.
Detalhes técnicos
- RMM abuse: a rogue RMM install gives persistent access that looks like admin activity; attackers use AI to build fake document-share and service-agreement lures.
- Mailbox manipulation: inbox rules redirect vendor replies to unmonitored folders (RSS Feeds, Archive) to alter invoices and redirect payments, with no malware involved.
- AiTM: the attacker proxies the Microsoft 365 login page and steals the session token, bypassing password and MFA while the session is valid.
- Device code phishing: abuses the legitimate Microsoft device code flow; the resulting access token can outlive a password reset.
- ClickFix: fake CAPTCHA or verification prompts trick users into pasting commands into a terminal, leading to infostealers or ransomware; about 2.2% of Managed EDR signals in 2026, nearly 99% of them high severity.
- AI platform abuse: fake desktop clients hosted on trusted AI domains (Claude, ChatGPT); FakeAgent used a malicious Claude Artifact to deliver SectopRAT.
Remediação
- Define and enforce which remote tools are approved, and alert on unapproved RMM installs.
- Monitor for mailbox rule changes and anomalous session or token activity.
- Be suspicious of unexpected device code prompts and unusual token activity.
- Prioritize defenses in order of the quadrant, starting with the top-right tactics.
Linha do tempo
-
Huntress ranks top SMB threats: RMM abuse, mailbox manipulation, AiTM, device code phishing, ClickFix and AI platform abuse
ler a análise desta fonte ocultar
Sponsored Huntress Labs content introduces the "Tragic Quadrant", a ranked view of tactics hitting small and mid-sized organizations, built on Huntress telemetry. The highest-priority tactics are those that abuse trusted tools: RMM abuse (45% of endpoint incidents investigated in Q1 2026), mailbox manipulation for BEC (24.6% of ITDR signals in 2026) and adversary-in-the-middle (AiTM) account takeover (18.9% of identity threats in 2025). Lower-priority but fast-evolving tactics are device code phishing, ClickFix and AI platform abuse. The article cites the EvilTokens PhaaS kit hitting 344 organizations in five countries in 16 days, and the FakeAgent campaign abusing a malicious Claude Artifact on claude.ai to deliver SectopRAT to 29 organizations in two days. The figures are vendor-reported and the piece is promotional.
Technical Details
- RMM abuse: a rogue RMM install gives persistent access that looks like admin activity; attackers use AI to build fake document-share and service-agreement lures.
- Mailbox manipulation: inbox rules redirect vendor replies to unmonitored folders (RSS Feeds, Archive) to alter invoices and redirect payments, with no malware involved.
- AiTM: the attacker proxies the Microsoft 365 login page and steals the session token, bypassing password and MFA while the session is valid.
- Device code phishing: abuses the legitimate Microsoft device code flow; the resulting access token can outlive a password reset.
- ClickFix: fake CAPTCHA or verification prompts trick users into pasting commands into a terminal, leading to infostealers or ransomware; about 2.2% of Managed EDR signals in 2026, nearly 99% of them high severity.
- AI platform abuse: fake desktop clients hosted on trusted AI domains (Claude, ChatGPT); FakeAgent used a malicious Claude Artifact to deliver SectopRAT.
Remediation
- Define and enforce which remote tools are approved, and alert on unapproved RMM installs.
- Monitor for mailbox rule changes and anomalous session or token activity.
- Be suspicious of unexpected device code prompts and unusual token activity.
- Prioritize defenses in order of the quadrant, starting with the top-right tactics.