LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses

Explore the latest tactics, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing in the quarterly TTP Briefing, a report built on frontline threat intelligence from our global incident response investigations across LevelBlue during Q2 2026.

Download the full report

Register for US Webinar: July 29th, 2026 | 11:00am ET

Register for EMEA Webinar: July 30th, 2026 | 11:00am BST

A Unified View of the Threat Landscape

This TTP Briefing is based on threat intelligence derived directly from LevelBlue incident response engagements worldwide over the past quarter. These engagements are technology-agnostic, providing a clear view into the real-world tactics, techniques, and procedures adversaries are using today.

This edition also incorporates threat intelligence from LevelBlue's recently integrated teams, including SpiderLabs, which broadens the dataset behind our findings.

Stolen Identities Are Outpacing Organizations’ Defenses

The common thread across nearly every Q2 finding is identity: attackers increasingly abuse the credentials, tokens, and machine identities that an environment already trusts.

Business email compromise (BEC) remained the most common incident type at 45%, MFA was defeated in every BEC case where it was deployed, and stolen OAuth tokens and API keys drove a wave of software supply chain intrusions. Even the most-exploited vulnerabilities, concentrated in internet-facing VPN and edge appliances, are valuable largely because they hand attackers valid access to the network rather than a foothold they still have to escalate. This is why stolen identities are outpacing traditional defenses: controls built to keep intruders out do little against an adversary who arrives already authenticated.

Phishing still opened 65% of intrusions, and social engineering such as the resurgent ClickFix campaign remains effective, but the bigger change is speed. Once inside, attackers now compress the intrusion path and shorten dwell time, reaching their objectives before defenders can respond.

For additional insights, join our IR experts on July 29 at 11:00am ET or July 30 at 11:00am BST for live webinars where they will explore our findings in more detail. Come armed with questions and walk away with actionable intelligence, detection priorities, and recommendations to strengthen your defenses.

Let’s explore a few key findings:

Most Common Threat Types

Figure 1. Most common threat types.

• Business email compromise (BEC) continued to be the most common threat incident type, accounting for 45% of incidents.

• Network intrusions without ransomware remained the 2nd most common incident type at 20%. This is in part due to organizations improving their detection capabilities and stopping threat actors from reaching encryption, as well as threat actors simply exfiltrating and extorting victims rather than encrypting.

• Cloud intrusion spiked to the 3rd most common incident type, largely due to an increase in software supply chain attacks, like the Klue compromise that occurred in June 2026.

Insider threat-related incidents, both intentional and inadvertent, rose in Q2 compared to Q1. This uptick during the months of April-June aligns with bonus and compensation season for many organizations, often, resulting in bad leavers and/or arrivers as shifts within employment statuses occur.

Software Supply Chain: When Attackers Skip the Intrusion Path

Software supply chain attacks kept rising in Q2, but the more important story is how they now unfold. By compromising a trusted vendor integration, attackers inherit the machine identities that place them deep inside the intrusion path from the very start, skipping the phishing, lateral movement, and privilege escalation that defenders are tuned to detect. That leaves far less time between initial access and impact.

OAuth token and machine identity abuse attacks continue to evolve as threat actors apply them to vendor integrations for persistent access to cloud environments. By obtaining OAuth tokens, API keys, and other machine identities, threat actors can gain access to any connected SaaS platform without triggering additional authentication controls. This type of initial-access abuse has driven the spike in software supply chain incidents like those of Klue, Vercel, and the Shai-Hulud campaign.

How the Klue Compromise Led to a Software Supply Chain Attack

In June 2026, an incident impacting Klue, a market intelligence platform, resulted in the compromise of associated API credentials, allowing for unauthorized access to Salesforce-connected integration services, and potentially other 3rd party SaaS services. The threat actor group, self-identified as “Icarus” or “Mr. Bean,” leveraged the compromised API keys to authenticate to Salesforce-connected environments and conduct automated API activity. As a result, threat actors were able to gain unauthorized access to Salesforce, impacting hundreds of organizations.

What this means for defenders: identity governance now extends well beyond human users. Organizations should inventory and continuously monitor the OAuth grants, API keys, and service accounts tied to third-party integrations, scope them to least privilege and rotate them on a regular cadence, and treat anomalous token or API activity as a primary detection signal, because a single trusted integration can be the first and only foothold an attacker needs.

Initial Intrusion Vector (How Are They Getting In?)

Figure 2. Initial intrusion vector.

Phishing remained the dominant initial intrusion vector in Q2 at 65%. External remote services (RDP, VPN) was the second most common initial intrusion vector at 9%. Valid accounts / credential abuse was a concern at 7%.

Everything Old Is New Again: ClickFix Social Engineering

ClickFix social engineering resurged in Q2.

In this social engineering campaign a victim receives a fake CAPTCHA, CloudFlare, or error-fix prompt that’s seemingly legitimate. In order to complete verification, users then paste attacker-supplied commands locally on their machine, which in turn allows attackers to bypass email security controls because the user executes the payload themselves.

Phishing/social engineering awareness training can help users spot these malicious patterns, and fake CAPTCHA prompts and copy-paste prompts should be incorporated into any training program to help educate against this type of threat.

Most Commonly Observed CVEs – Q2

The CVEs our incident response teams saw exploited most often in Q2 share a clear, almost familiar pattern by now: nearly all target internet-facing edge, VPN, and network security appliances. Eight of the nine below are perimeter devices, and many of the flaws are authentication bypasses or unauthenticated remote code execution that require no valid credentials to exploit.

Unfortunately, the exploitation of edge devices has been a challenge for a very long time. Organizations should patch internet-facing systems on an emergency cadence, restrict management interfaces to trusted networks, and actively monitor these devices for exploitation attempts.

MFA Bypass Hits 100%

Figure 3. MFA Bypass hits 100%.

In Q2, 91% of organizations that suffered an incident had MFA implemented, increasing since last quarter. Yet, this didn’t stop threat actors from overcoming every single instance where MFA was implemented during a BEC incident. This is in part due to sophisticated phishing kits that are readily available at low cost capable of intercepting authenticated token responses, and unique social engineering tactics that convince victims to approve third-party apps unknowingly in furtherance of gaining approved and authenticated access. Just as significant, MFA is no longer challenged after the first time it is approved due to the threat actor authenticating with valid OAuth tokens, API keys or authorized apps that sidestep the need to re-authenticate during the threat actor’s path of intrusion.

Although MFA bypass is at an all-time high, it’s still an essential security control to have in place and serves as an important first line of defense. Organizations should implement phishing-resistant MFA (such as FIDO2 or passkeys) to defeat the phishing kits that intercept session tokens, but that is only half the answer. Because attackers increasingly rely on valid tokens rather than defeating the prompt, pair MFA with continuous session-token monitoring, short token lifetimes, and conditional-access policies that flag anomalous token use.

Most Targeted Industries and Company Sizes

Figure 4. Most targeted industries and company sizes.

Financial services remained the most targeted industry (28%). This quarter, education and research jumped to the second most impacted sector (13%) from 7% in Q1, aligning with the end of the school year and exam periods, making them a more enticing target for threat actors. Legal and professional services was the third most targeted industry, accounting for 11%, up from 7% in Q1.

Organizations with revenue between $1M–$100M accounted for the largest share of incidents, in Q2, reinforcing that threat actors increasingly view mid-market companies as high-value, lower-resistance targets.

Tactics Across the Intrusion Path

 Figure 5. Trends across the intrusion path.

The TTP Briefing provides data across the five stages of the intrusion path, from initial access to persistence and escalation techniques, to exfiltration and monetization tactics. Noteworthy findings include:

• Threat actors continue to leverage Anydesk and PSExec as the most common tools for persistence

• Credential stealers, like mimikatz, continue to be common to escalate privileges

• Software supply chain incidents appeared to be on the rise, skipping several steps in the intrusion path and compressing the time “end goal”
• Tools like GraphAPI were used during this stage as APIs were leveraged to pull data/services from one platform to another.

A Look Into Dwell Time

Figure 6. A look into dwell time.

In the TTP Briefing, we exclude any MDR clients and measure dwell time from the initial date of the compromise until our IR team is engaged. This quarter, average dwell time decreased when compared to the previous quarter. The share of cases resolved within 3 to 10 days jumped from 23% in Q1 to almost half (42%) in Q2, while the share dragging on for 31 days or more fell from 38% to 23%. This indicates a shift in threat actor behavior, as they are moving faster within victim networks subsequently reaching their end goals faster, and therefore avoiding detection and ejection. They are doing so with more sophisticated tactics and techniques, and with tools like living-off-the-land binaries and AI. In addition to expedited threat actor behavior, organizations have increased their ability to detect malicious behavior earlier, engaging incident response providers quicker to stop the threat and eject the bad actor.

Download the full TTP Briefing

Register for US Webinar: July 29th, 2026 | 11:00am ET

Register for EMEA Webinar: July 30th, 2026 | 11:00am BST

If you would like more information about this report, our team is available 24/7 at response@levelblue.com