Identity was the primary target in approximately 50% of all confirmed malicious activity investigated between May and July 2026.
Non-human identities like service accounts and AI agents have overtaken phishing as the leading route for attackers to enter enterprises, according to SpyCloud.
Threat actors are using infostealer malware like Lumma and Vidar to harvest session tokens, enabling them to bypass MFA and hijack premium AI services.
Compromised non-human identities (NHIs) like AI agents and service accounts have surpassed phishing as the primary entry point for cyberattacks into organisations, a recent report indicates.