Identity-Based Attacks Target Half of Confirmed Malicious Activity

Identity-based attacks were the target in approximately 50% of all confirmed malicious activity between May and July 2026, according to a threat report from Prophet Security.

The investigation, which analysed 4.7 million security questions, found that while 93% of investigated alerts were benign, the remaining 7% of confirmed malicious activity followed several distinct patterns. Most notably, the report highlighted a single novel event in which an AI agent executed a complete intrusion during a model evaluation conducted with safety settings disabled.

Session hijacking bypasses authentication controls

Direct attacks on accounts and sessions accounted for roughly 18% of confirmed malicious activity. A primary factor in attacker success was the authentication method used. While phishing-resistant multi-factor authentication (MFA) successfully blocked many adversary-in-the-middle proxies, attackers repeatedly succeeded using already-authenticated sessions.

Because replayed session cookies allow attackers to skip the initial authentication phase, standard conditional access checks are often not triggered. This allowed attackers to maintain continuous access to email accounts for weeks. In some instances, attackers even modified authentication methods or granted OAuth consents after an account had been disabled by security teams.

Infostealers delivered via web browsers

Infostealer activity, which accounted for 23% of confirmed malicious activity, was primarily delivered through web browsers rather than email. Attackers utilised compromised legitimate websites, malicious advertisements, and fake CAPTCHA gates, known as ClickFix, to bypass automated sandboxing by requiring human interaction.

Commonly identified payloads included Lumma Stealer, Vidar, HijackLoader, and AsyncRAT. These tools often targeted the browser’s cookie store to extract Microsoft authentication cookies, enabling attackers to make authenticated API requests without needing a password or MFA. This method of compromise can survive a password reset or even a device wipe if the session is not explicitly revoked.

Highly targeted phishing campaigns

Credential phishing represented the largest single category of malicious activity at 28%. These campaigns were highly targeted, frequently hitting the same individuals over several months. Attackers focused heavily on financial roles, such as finance executives, accounts payable, and treasury departments.

To maintain persistence, attackers frequently modified mailbox rules to delete or hide incoming emails, preventing victims from noticing suspicious activity. These inbox rules often remain in place even after a user performs a password reset, allowing attackers to stay hidden within the network.

Intrusions on unmonitored assets

The longest-running security intrusions, making up about 9% of malicious activity, occurred on assets where no endpoint detection and response (EDR) agent was installed. These unmonitored hosts, including production identity servers and unmanaged devices, allowed attackers to conduct lateral movement and credential access for several weeks before detection.

In these cases, attackers often used legitimate Windows tools, such as accessibility utilities and task manager, to access the Local Security Authority Subsystem Service (LSASS) to harvest credentials.