Half of All Real Attacks Now Target Logins, Says Prophet Security Review
A quarter of investigating every alert across customer environments shows identity abuse, help-desk trickery and old-school phishing still doing most of the damage.
Key points
- Prophet Security reviewed every confirmed malicious alert across its customer base from May to July 2026 and found identity attacks accounted for roughly half of all real incidents.
- The four dominant patterns were credential abuse, help-desk social engineering, phishing with adversary-in-the-middle kits, and misuse of legitimate remote-access tools.
- Attacks that bypassed multi-factor authentication almost always relied on session cookie theft rather than breaking the login itself.
- Fast human triage, not new tooling, was the single biggest factor in stopping attacks before data left the network.
Prophet Security, first reported by BleepingComputer, reviewed every alert its analysts touched for a full quarter and asked: when an attack actually worked, how did it work?
The answer, across May to July 2026, wasn't exotic. It was logins.
Roughly half of confirmed malicious activity targeted identity: usernames, passwords and session tokens. The rest split between phishing pages, abuse of trusted remote-access software, and social engineering aimed at IT help desks.
One caveat: this is one vendor's telemetry, weighted toward mid-market companies that already run a managed detection service. It isn't the whole internet. But the patterns line up with what other incident-response shops have been saying for a year.
What are the four attack patterns?
Prophet's analysts grouped confirmed incidents into four categories. First, credential abuse: attackers logging in with valid usernames and passwords bought from criminal markets or scraped from earlier breaches. No malware, no exploit.
Second, help-desk social engineering. Someone calls IT pretending to be an employee locked out of their account and talks a support agent into resetting the password or enrolling a new phone for multi-factor authentication (the extra verification step after a password). This mirrors technique tracked by Microsoft and others under the cluster Scattered Spider, though Prophet doesn't attribute the incidents it saw to any named group. We covered the rise of this approach on 9 September in "When Password Resets Become the Front Door".
Third, phishing, where criminals send fake emails to trick staff into handing over passwords, but with a twist. The lures pointed to adversary-in-the-middle pages: fake login screens that quietly pass the victim's password and one-time code through to the real site, then steal the session cookie the real site hands back. That cookie lets the attacker skip the login entirely on their own machine. Our 7 September story on phishing kit BigBear showed how the same mechanic stripped 4,148 session cookies from victims across 40 countries.
Fourth, abuse of legitimate remote-access tools like AnyDesk and ScreenConnect. Attackers install these instead of custom malware because security software rarely blocks them.
Why did multi-factor authentication not stop it?
Because the attackers usually didn't try to beat it. They stole the session cookie after the user had already logged in, or they convinced a help-desk agent to enrol a new device on the victim's account.
Cookie theft is a growing headache. Once an attacker has that cookie, the target's own security controls treat the intruder as the real user. Nothing lights up. This behaviour overlaps with tradecraft attributed to several financially motivated clusters, and the tooling is now sold as a service on criminal forums. We went deep on why the cookie matters more than the password on 3 September.
What worked in defence?
The blocked attacks in Prophet's dataset shared a common trait: a human looked at the alert within minutes, not hours.
| Attack pattern | Share of confirmed incidents | Common defence that worked |
|---|---|---|
| Credential abuse | Largest single category | Blocking logins from unusual locations |
| Help-desk social engineering | Significant | Callback verification to a known number |
| Adversary-in-the-middle phishing | Significant | Phishing-resistant hardware keys |
| Remote-tool abuse | Smaller but growing | Allow-listing approved remote software |
Prophet's pitch is that AI-assisted triage lets small security teams respond at that speed. Fair enough. The wider point stands on its own: the attacks winning right now are the ones that look like normal user behaviour, and they get caught by people who know what normal looks like on their own network.
Should you worry about the help desk?
If your IT help desk calls you out of the blue to confirm a password reset you didn't request, that's the attack. Hang up. Call IT back on a number you already know.
