Phishing attacks were the dominant method of initial entry for cyber incidents that required remediation during the last quarter, analysis of attacks by the incident responders who were called in to deal with them has revealed.
This as campaigns have become more innovative around evading detection.
According to the Cisco Talos Incident Response Trends report for March to June 2026, published on July 28, phishing accounted for the initial attack vector in just over half of incidents investigated.
This represented a significant rise compared with the previous quarter, when Cisco Talos reported that phishing attacks represented the initial entry point for a third of incidents they investigated.
Other top observed initial access vectors included exploitation of public-facing applications and drive-by compromise attacks, which happen when users visit compromised websites designed to deliver malicious code to victims.
The rise in phishing coincides with a period which saw attackers experiment with new tools and techniques to help the attacks socially engineer victims, while also evading the cybersecurity protections designed to detect against malicious intrusions.
An example of this, as detailed by researchers, was a QR code phishing campaign which targeted organizations in an effort to harvest login credentials and further propagate the attacks by automatically targeting the victims’ contacts too.
The campaign, which is described as persistent and was ongoing as of late June 2026, uses auto-generated victim-tailored PDF documents which contain QR codes that direct victims to adversary-controlled Microsoft 365 credential harvesting pages.
Attributed by Cisco Talos to a threat actor they dubbed UAT-11764, the campaign uses two methods to help bypass protections.
First, the QR codes evade detections used by many traditional email gateways to identify potentially malicious behavior. Second, the credential harvesting pages are hosted on trusted cloud platforms, something which might not be flagged by cybersecurity solutions.
Once the credentials had been successfully stolen, in addition to accessing the victim’s inbox, the attacks conducted various post-compromise actions including creating email inbox rules for defense evasion, as well as using the compromised account to send further phishing emails.
“By weaponizing existing, trusted infrastructure like SharePoint and Microsoft 365, UAT-11764 can bypass many standard email security gateways,” the paper warned.
“As such, network defenders should implement policies that block or flag emails containing QR codes within PDF attachments, enforce phishing-resistant multi-factor authentication on Microsoft 365 accounts, and monitor for suspicious inbox rule creation and anomalous SharePoint file staging as indicators of post-compromise activity.”
Phishing-as-a-Service Kits With Expanded Capabilities
The report also noted phishing-as-a-service (PhaaS) kits are becoming more complex and powerful, providing cybercriminal users with a whole suite of tools designed to make attacks more effective.
This ranged from toolkits to secretly bypass MFA through the OAuth device authorization flow rather than stealing passwords, to services which provide users with a comprehensive post-compromise toolkit to help the attacker meet their goals, such as searching for specific information in emails with keyboards.
Capabilities observed while investigating incidents during the period included capabilities including automated token management, persistent access through Primary Refresh Tokens (PRTs), OneDrive and SharePoint administration, geo-dynamic templates, inbox rule manipulation, cross-account keyword monitoring, and collaborative token sharing.
Researchers also identified advanced anti-analysis techniques, including layered evasion mechanisms and encrypted client-side payloads.
According to the report, techniques like this highlight “the increasing sophistication of modern PhaaS platforms”
To help protect networks and users against phishing attacks and other cyber threats, Cisco Talos offered the following advice:
- Implement properly configured, phishing-resistant MFA and tighten authentication controls
- Configure centralized logging with adequate retention across the environment
- Conduct robust patch management and reduce exposed infrastructure
- Enforce strict outbound email thresholds to disrupt attack propagation
