The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest

Cyber headlines often focus on the flashy attacks, but the ones that actually cause OH $#!T moments are the tactics that abuse the tools and workflows you already trust. If you run a small or mid-sized organization, whether you handle IT yourself or outsource it, it’s a constant race to keep up with attackers and their evolving tactics.

The bottom line is that you need to know which attacks are landing in environments like yours, and how to prioritize your defenses against them.

The Tragic Quadrant at a Glance

That’s why Huntress created the Tragic Quadrant, a ranked list of the cyber tactics putting businesses at risk, built to show you where to focus regardless of what’s trending week to week.  

Figure 1: The Huntress Tragic Quadrant

Fix These Threats First: The OH $#!T Corner

Each of these tactics hides inside something your team uses every day, like a remote access tool or a Microsoft 365 login.

RMM Abuse Is Steady and Holding

Remote monitoring and management (RMM) tools are a staple for IT teams, which is exactly why attackers abuse them. One rogue RMM install gives an attacker persistent access that looks like ordinary admin work.

In Q1 2026, 45% of endpoint-related incidents Huntress investigated involved RMM abuse. Attackers are also using AI to build convincing fake document shares and service agreement lures that trick users into installing unwanted RMMs.

Mailbox Manipulation Is an Entry Point to BEC

So far in 2026, 24.6% of Identity Threat Detection and Response (ITDR) signals point to mailbox manipulation and persistence. With mailbox access, an attacker can change inbox rules and send vendor replies to folders nobody is watching, like RSS Feeds or Archive.

From there, they can tweak invoice details and redirect payments to their own accounts, all without any malware for detection tools to flag.

Account Takeover That Sidesteps MFA

Adversary-in-the-middle (AiTM) attacks made up 18.9% of all identity-based threats Huntress tracked in 2025. The attacker sits between the victim and the real Microsoft 365 login page, steals the session token in transit, and forwards everything along so nothing looks off to the user.

As long as that session is valid, the attacker can access the account without a password or a fresh MFA prompt.

Your Next Stop: The Other Three Corners

Once you’ve covered the top-right tactics, the others still deserve a plan. Each one is evolving fast, potentially moving toward the OH $#!T corner at any time.

Device Code Phishing Turns Low-Key Deadly

Device code phishing is less common, but it rides on Microsoft’s real device code login flow, so “check the URL” advice doesn’t help. A convincing prompt nudges someone to enter a short code on a genuine Microsoft page, and the attacker walks away with an access token that can outlive a password reset.

In one 16-day window, a phishing-as-a-service (PhaaS) kit called EvilTokens hit 344 organizations across five countries. Defenders should be suspicious of unusual device code prompts and odd token activity.

ClickFix Is a Daily Intrusion Pest 

ClickFix leans on the copy-paste muscle memory people use to get past everyday friction. A fake CAPTCHA or “verification failed” prompt tricks someone into pasting a malicious command into their terminal. The paste itself triggers the malicious code, so no exploit chain is involved, and it can lead to infostealer malware or ransomware.

ClickFix accounts for about 2.2% of Managed Endpoint Detection and Response (EDR) detection signals so far in 2026, but nearly 99% of those detections are high severity.

AI Platform Abuse Is Overhyped, for Now

This one sits in the overhyped corner because it’s still an emerging pattern. Attackers hide malicious content behind real AI tools and workflows people trust.

A fake “desktop client” or “productivity helper” might live inside a shared conversation or a hosted artifact on a trusted AI domain like Claude or ChatGPT, which makes it tricky to tell what’s malicious.

In one case, FakeAgent used a malicious Claude Artifact on the real claude.ai domain to send people looking for Claude Desktop to SectopRAT, reaching 29 organizations in two days.

Figure 4: FakeAgent hosted a malicious Claude Artifact on the real claude.ai domain to spread SectopRAT.

Make the Tragic Quadrant Your Starting Point

The Tragic Quadrant helps you pick what to fix first when everything feels urgent.

Start in the top right corner and ask a few simple questions: Which remote tools are approved, and how do we catch mailbox rule changes and odd session behavior before they turn into something worse?

Grab your copy of the Huntress Tragic Quadrant to work through every corner on your own timeline and decide which gaps to close next

Sponsored and written by Huntress Labs.