The Top 4 Threats We Found by Investigating Every Alert for a Quarter

Summary

Prophet Security's analysis of customer alerts between May and July 2026 revealed that identity was the target in approximately half of all confirmed malicious activity. The top attack pattern observed was session hijacking, where attackers leveraged already-authenticated sessions to bypass security controls, leading to successful account takeovers. While password-based attacks were often blocked by security measures like conditional access and phishing-resistant MFA, replayed session cookies and refresh tokens circumvented these defenses.

Full text

The Top 4 Threats We Found by Investigating Every Alert for a Quarter Sponsored by Prophet Security September 10, 2026 10:00 AM 0 Tl;dr: Identity was the target in roughly half of all confirmed malicious activity. Prophet Security breaks down the four main attack patterns seen across customer environments between May and July 2026, and explains why some attacks succeeded while others were blocked. Between May 1 and July 31, 2026, Prophet Security investigated every alert in customer environments immediately upon arrival. This removes a common blind spot in threat datasets: the human analyst's decision about which alerts deserve a full investigation. Of the completed investigations, about 93% were benign and 7% were confirmed malicious. The findings below come from that 7%. They are based on 4.7 million questions asked of customer environments over the quarter, with a median of 35 questions per investigation. Prophet Security published the full dataset in its first quarterly threat report. Figure 1: The malicious activity our AI SOC analyst identified One key finding stands out: identity was the target in roughly half of all confirmed malicious activity this quarter. The strongest predictor of a successful account takeover was whether the attacker used a password or an already-authenticated session. This was true for both direct attacks on accounts and phishing campaigns. Here are the four patterns we observed: 1. Session hijacking was the top way attackers broke into accounts Direct attacks on accounts and sessions made up about 18% of confirmed malicious activity. These included session hijacking, token replay, MFA bypass, credential stuffing, and post-compromise persistence using inbox rules and OAuth consent grants. The main factor predicting success was the authentication method the attacker used. Attempts using a password were usually blocked. For example, conditional access blocked correct passwords coming from commercial VPNs in new countries or unfamiliar hosting providers. Phishing-resistant MFA stopped adversary-in-the-middle proxies that captured credentials. The security controls worked as intended. However, attempts using an already-authenticated session succeeded repeatedly. In some cases, individual accounts had dozens of malicious sign-ins over three weeks, giving attackers continuous access to emails. The reason is simple: standard conditional access checks during authentication. Since a replayed session cookie skips authentication, no policy is triggered. A refresh token only returns to the identity provider when redeemed, which is the only time to re-evaluate and revoke access. While passwords hit security controls, authenticated sessions bypassed them completely. Figure 2: Stolen, already authenticated sessions bypass typical security controls This led to two common outcomes. First, disabling the account didn't always stop the attacker. At two organizations, attackers continued using access granted before the account was disabled. In one case, they even changed authentication methods and granted OAuth consents while the security team thought the incident was closed. Second, when credentials were phished instead of sessions being stolen, the timing revealed relay infrastructure. For example, a login from one country was followed by an MFA approval from another country just sixteen seconds later, and again after 118 seconds on a second attempt. Such a short gap between countries indicates a real-time proxy intercepting and relaying credentials and approvals. MFA fatigue attacks also succeeded when allowed by the system. One attacker sent repeated prompts from a residential proxy until the user approved. Another used a combination of brute force, lockout, automatic unlock, and push bombing to register a new device, exploiting the automatic unlock policy. The Prophet Security Quarterly Threat Report The Prophet Security Quarterly Threat Report details a complete account takeover, from the initial login to the artifact that bypassed a password reset. It also includes hardening recommendations for these threats. Get the Full Report 2. Infostealers delivered via browsers were the primary source of stolen sessions Malicious code execution and tooling accounted for about 23% of confirmed malicious activity. Overall, infostealer activity affected roughly a quarter of the investigated organizations. These infostealers were mostly delivered through web browsers, not emails. Attackers used compromised legitimate websites, malicious ads, sponsored search results, and fake CAPTCHA gates (known as ClickFix) that bypass automated sandboxing by requiring a human click. Fake update prompts hosted on compromised sites were frequently seen across multiple organizations. Attackers often lured users with software they wanted. Trojanized installers were the most common initial foothold, found at about a quarter of organizations. For example, a trojanized version of a popular AI application ran from a downloads folder, disabled Windows Defender, set up a highly privileged scheduled task, and opened command-and-control channels. Similar techniques were used to hide malware in hardware diagnostic tools, public code packages, screenshot utilities, cracked software, and remote-support tools. We identified delivery tools like ClearFake and SocGholish, and payloads including Lumma Stealer, Vidar, HijackLoader, and AsyncRAT. While SocGholish infrastructure was disrupted on June 18, 2026 under Operation Endgame (during our reporting period), its fake update model continues to be used by ClearFake and other groups, showing that the technique survives even when the operators are shut down. These stolen sessions often come from the browser's cookie store. In one case, a script decrypted the browser's cookie store, extracted Microsoft authentication cookies, and used them to make authenticated API requests. This is how attackers get the session cookies they replay to bypass security. A stolen cookie requires no password or MFA, and it survives a password reset or even a device wipe if the session isn't revoked. Ultimately, an endpoint compromise quickly becomes an identity compromise through the browser. 3. Phishing attacks were highly targeted Credential phishing made up about 28% of confirmed malicious activity, making it the largest single category. These attacks primarily aimed to steal credentials or sessions rather than deliver malware. These campaigns were highly targeted, often hitting the same people repeatedly. For example, one finance executive faced dozens of different phishing campaigns over three months. Another recipient was targeted for months, while someone else received near-identical phishing emails from different domains twice in two weeks. Figure 3: These campaigns often hit the same people (often in financial roles) repeatedly Attackers focused on financial roles: finance executives, collections, accounts payable, treasury mailboxes, and company leaders receiving ACH-themed lures. In one instance, they targeted an automated invoice-processing mailbox, which lacks a human user to spot suspicious activity. The phishing emails often came from trusted infrastructure, such as legitimate collaboration platforms, major cloud email services, and consumer file-sharing links. Some messages impersonated internal systems like calendar services. Attackers used modern tactics: Unicode characters in subject lines to evade filters, newly registered domains, typosquatted domains, and tracking pixels to verify when an email was opened. Standard email authentication checks weren't always effective. In one case, a spoofed message that failed SPF, DKIM, and DMARC still reached over a dozen inboxes. The time it took to remove malicious emails varied from seconds to over a day. Organizations with automated remediation removed emails in seconds. Without it, a CEO impersonation lure sat in a finance director's inbox for nearly a full workday. Once attackers gained acc

Entities