Prophet Security’s quarterly threat report shows that identity was the focus of about half of confirmed malicious activity between May and July 2026, with stolen sessions, phishing, infostealers, and unmonitored assets driving the most successful intrusions. The report also finds that many attacks survived password resets because attackers relied on session hijacking, inbox rules, and remote access tools that bypassed standard controls. #ProphetSecurity #OperationEndgame #ClearFake #SocGholish #LummaStealer #Vidar #HijackLoader #AsyncRAT
Keypoints
- Identity was targeted in roughly half of all confirmed malicious activity.
- Stolen authenticated sessions were more successful than password-based attacks.
- Browser-delivered infostealers were a major source of session theft.
- Phishing campaigns heavily targeted finance-related roles and mailbox users.
- Unmonitored assets enabled the longest-running intrusions and persistence.