IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

1. Executive summary

Cisco Talos published its Q2 2026 IR trends report, identifying phishing as the dominant initial-access vector (present in >50% of engagements) with a sharp rise in authentication abuse (65% of engagements, up from 35%). Three threat clusters are relevant to EMEA financial services: (1) a persistent QR-code phishing campaign dubbed "UAT-11764" targeting M365 tenants via compromised accounts and SharePoint staging; (2) the ARToken PhaaS platform — linked to EvilTokens — offering device-code phishing, PRT persistence, and BEC tooling with 80+ API endpoints; and (3) ransomware operators Sinobi, Nitrogen, and Warlock weaponising legitimate RMM tools (trojanized MeshAgent, Zoho Assist) for stealthy C2 and domain-wide encryption. All named actors lack MITRE ATT&CK profiles; attribution is unconfirmed. No CISA-KEV-listed CVEs are referenced in this item.

2. Regulatory framing

3. Technical analysis & attack chain

3.1 UAT-11764 QR-code phishing campaign (ongoing since April 2026)

Attribution: UAT-11764 — no MITRE ATT&CK profile; attribution unconfirmed. Talos assesses with high confidence the actor will continue operations. Single-sourced (Talos only); verify before enforcement.

1. Initial access: Adversary sends QR-code-embedded PDF attachments to targets (primarily Australian organisations), bypassing traditional email gateways that do not inspect image-embedded URLs.
2. Credential harvest: QR codes direct victims to adversary-controlled M365 credential-harvesting pages.
3. Account compromise: Captured credentials used to access victim Microsoft accounts.
4. Persistence / defence evasion: Adversary creates email inbox rules to hide inbound security alerts or suspicious messages (T1564.008).
5. Lateral propagation via trusted infrastructure: Compromised mailbox contact lists used to send additional internal and external phishing emails (T1534 Internal Spearphishing). SharePoint used to host malicious documents, leveraging Microsoft's domain reputation to bypass email security gateways.
6. Observed impact: Self-sustaining compromise chain — each newly compromised mailbox expands reach via its contact list.

3.2 ARToken / EvilTokens PhaaS platform

Attribution: ARToken is assessed as an EvilTokens affiliate based on overlapping infrastructure, API contracts, and operational patterns. No MITRE profile for any associated actor. Corroborated by Talos, Sekoia, Microsoft, and The Register.

1. Initial access — vendor-impersonation lure: Targeted (not spray-and-pray) emails spoof a legitimate vendor relationship. Observed example: email spoofing a Wisconsin plumbing/fire-protection contractor, sent to accounts-payable staff at a U.S. life-sciences company. Lure theme: outstanding-invoice query ("the following invoices appear to still be outstanding… advise when this will be processed"). The "from" header presents the contractor's real domain; reply-to redirects to an unrelated domain. Visible anchor text reads as the vendor's genuine SharePoint tenant; actual href points to a look-alike tenant (e.g., mononapfpcom) under an attacker-controlled M365 workspace — but still on legitimate sharepoint.com, inheriting clean reputation.
2. MFA bypass via OAuth device-code flow: ARToken abuses Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) to capture victim tokens, bypassing MFA entirely — no password theft required.
3. Post-compromise toolkit (80+ API endpoints): - Automated token management - Persistent access via Primary Refresh Tokens (PRTs) - OneDrive and SharePoint administration - Email access and BEC operations (send-as-victim, inbox rule creation, keyword-based cross-account monitoring) - SharePoint exfiltration - Geo-dynamic phishing templates - Collaborative token sharing among operators
4. Anti-analysis (7-layer client-side evasion): - Layer 1: User-Agent regex blocking headless browsers, Selenium, Puppeteer, Playwright, crawlers, wget, curl - Layer 2: navigator.webdriver check - Layer 3: Browser feature fingerprinting (window.chrome, navigator.vendor, touch/mouse APIs) - Layer 4: Window dimension analysis (catches 0x0 outer dimensions) - Layer 5: Interaction telemetry (requires 3+ mouse moves or 1+ touch events) - Layer 6: Timing gate (minimum 800ms since page load) - Layer 7: Movement pattern analysis (validates non-linear mouse trajectories)
5. Infrastructure: Panel served at dashboard-bl.pamconj[.]com (React SPA, 1.7MB compiled JS bundle, page title "ARToken Panel"). C2 API at spx.pamconj[.]com. Phishing lures deployed via Cloudflare Workers (e.g., clear90489058903-document.workers[.]dev). EvilTokens broader infrastructure: ~500 Cloudflare Workers domains, >1,000 phishing pages (Sekoia data).

3.3 Sinobi ransomware (first observed by Talos IR, April 2026)

Attribution: Sinobi — no MITRE ATT&CK profile; attribution unconfirmed. RaaS operation emerged ~1 year ago with minimal public reporting. Single-sourced (Talos only).

1. Initial access: Not specified in source material for this engagement.
2. C2 establishment — trojanized MeshAgent: Actor deployed a weaponized MeshAgent binary (open-source agent component of MeshCentral RMM platform) as primary C2. Installed as a SYSTEM-level auto-start service. Communicates over encrypted WebSocket (WSS) to attacker-controlled server, blending with legitimate remote management traffic.
3. Credential access: Actor obtained service account credentials from the domain credential store (nts.dit) — password was weak and easily cracked.
4. Lateral movement: RDP (T1021.001) and WinRM using the compromised service account.
5. Domain-wide deployment: Ransomware deployed across entire domain via malicious Group Policy Object (GPO) logon script.
6. Data exfiltration: rclone.exe used for staging data exfiltration prior to encryption.
7. Impact: Files encrypted with .SINOBI extension. Actor maintained undetected access for approximately 3 days before ransomware deployment.

3.4 Warlock ransomware / Storm-2603

Attribution: Warlock / Storm-2603 — no MITRE ATT&CK profile; attribution unconfirmed. Single-sourced (Talos only).

1. RMM abuse: Operators deployed installer for Zoho Assist Unattended Agent (designed for administrative remote control without a logged-in user). Not previously attributed to Warlock in public reporting.
2. Observed impact: In one engagement, activity did not lead to encryption but was consistent with a successful Warlock attack observed in May 2026. The RMM tool provides persistent, stealthy, unrestricted endpoint control.

3.5 Nitrogen ransomware

Referenced as a previously seen variant active this quarter. No additional technical detail provided in the source material.

3.6 Systemic weaknesses observed (Q2 2026)

4. Mitigation & containment

P1 — Within 24 hours

• Block QR codes in PDF attachments via email gateway policy. Flag or quarantine inbound emails containing PDF attachments with embedded QR codes.
• Enforce phishing-resistant MFA (FIDO2/WebAuthn, hardware security keys) on all M365 accounts. Deprioritise push/SMS-based MFA.
• Block legacy authentication via Conditional Access policies.
• Restrict self-service MFA enrollment — require helpdesk verification for device registration.
• Hunt for trojanized MeshAgent: Audit all running MeshAgent.exe processes and SYSTEM-level auto-start services. Baseline legitimate MeshCentral deployments; quarantine and investigate any unauthorised instances. Check WSS outbound connections from unexpected hosts.
• Hunt for Zoho Assist Unattended Agent: Audit for unauthorised installations of Zoho Assist across endpoints. Investigate any installer activity not initiated through approved IT change management.
• Block known ARToken infrastructure at network egress: dashboard-bl.pamconj[.]com, spx.pamconj[.]com, clear90489058903-document.workers[.]dev.
• Implement outbound email rate limiting on M365 tenants to disrupt mailbox-compromise propagation. Set thresholds well below the 6,600-message volume observed in one incident.

P2 — Within 72 hours

• Monitor for suspicious inbox rule creation — alert on rules that move emails to hidden folders, mark as read, or auto-delete, especially rules created outside normal business hours or via unfamiliar IP/device.
• Monitor SharePoint for anomalous file staging — alert on bulk file uploads, external sharing link creation, or uploads of PDF/executable files from new or unusual accounts.
• Audit service account permissions — identify service accounts with domain-level privileges, enforce strong passwords (25+ chars), and rotate credentials for any account whose password is crackable.
• Monitor for rclone.exe execution from non-standard paths or with external cloud storage destinations.
• Implement Conditional Access requiring device compliance and trusted infrastructure as access conditions, not geographic location alone.
• Enable number matching / verified push where phishing-resistant MFA is not yet deployed.
• Hunt for GPO-based deployment scripts — audit Group Policy Objects for unauthorised logon scripts, especially any pushed to domain-wide OUs.

P3 — Within 7 days

• Implement SIEM or centralized logging with minimum 90-day retention. Forward logs from domain controllers, servers, workstations, network infrastructure, cloud identity providers, and security appliances off-device to survive log tampering and host rebuilds.
• Enable process-creation, command-line, and cloud API auditing (e.g., Microsoft Graph audit logs).
• Establish application allowlisting to prevent unauthorised binaries (including trojanized RMM agents) from running as services.
• Decommission or isolate all end-of-life and externally exposed systems. Restrict management plane and remote access services behind VPN or trusted source.
• Deploy WAF rules for known exploitation patterns targeting Telerik UI deserialization and ToolShell.
• Conduct retrospective review of accounts-payable communications for vendor-impersonation indicators matching the ARToken lure pattern (outstanding-invoice queries, SharePoint links to look-alike tenants).

5. Indicators of compromise

domain  dashboard-bl[.]pamconj[.]com
domain  spx[.]pamconj[.]com
domain  clear90489058903-document[.]workers[.]dev
url  hxxps://mononapfpcom[.]sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc
file_extension  .SINOBI
binary  MeshAgent.exe
binary  rclone.exe
binary  Zoho Assist Unattended Agent
file  ntds.dit

Behavioural indicators

6. Detection

rule Talos_ARToken_Panel_SPA {
  meta:
    author = "Adverse Trace"
    date = "2026-07-28"
    reference = "https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/"
    description = "Detects ARToken panel React SPA bundle based on page title and infrastructure"

  strings:
    $title = "ARToken Panel" ascii wide
    $api_host = "spx.pamconj.com" ascii wide
    $panel_host = "dashboard-bl.pamconj.com" ascii wide

  condition:
    2 of them
}

rule Sinobi_Ransomware_Artifacts {
  meta:
    author = "Adverse Trace"
    date = "2026-07-28"
    reference = "https://blog.talosintelligence.com/ir-trends-q2-2026/"
    description = "Detects Sinobi ransomware file extension marker"

  strings:
    $ext = ".SINOBI" ascii wide

  condition:
    $ext
}

title: Suspicious MeshAgent Service Installation as SYSTEM
id: AT-2026-07-28-421-meshagent
status: experimental
author: Adverse Trace
date: 2026/07/28
description: Detects MeshAgent binary installed as an auto-start service running as SYSTEM, consistent with Sinobi C2 tactic
references:

  - https://blog.talosintelligence.com/ir-trends-q2-2026/
logsource:
  product: windows
  service: system
detection:
  selection_service_create:
    EventID: 7045
    ServiceName|contains:

      - "MeshAgent"
      - "Mesh Central"
      - "MeshService"
    ServiceType: "Service in own process"
    ServiceStart|contains:

      - "auto"
  filter_legitimate_meshcentral:
    ImagePath|contains:

      - "meshcentral"
    ServiceName|contains:

      - "Mesh Central Agent"
  condition: selection_service_create and not filter_legitimate_meshcentral
falsepositives:

  - Legitimate MeshCentral deployment via approved IT change management
level: high

title: Suspicious Inbox Rule Creation for Defense Evasion
id: AT-2026-07-28-421-inbox-rule
status: experimental
author: Adverse Trace
date: 2026/07/28
description: Detects creation of inbox rules that move, mark-as-read, or delete emails, consistent with UAT-11764 and ARToken post-compromise behavior
references:

  - https://blog.talosintelligence.com/ir-trends-q2-2026/
logsource:
  product: microsoft365
  service: exchange
detection:
  selection:
    eventSource: Exchange
    eventName: New-InboxRule
    RuleActions|contains:

      - "MoveToFolder"
      - "DeleteMessage"
      - "MarkAsRead"
  suspicious_keywords:
    RuleName|contains:

      - "spam"
      - "archive"
      - "read"
      - "delete"
      - "junk"
      - "rss"
      - "calendar"
  condition: selection and suspicious_keywords
falsepositives:

  - Legitimate user-created inbox rules
level: medium

title: GPO Logon Script Deployment Domain-Wide
id: AT-2026-07-28-421-gpo-script
status: experimental
author: Adverse Trace
date: 2026/07/28
description: Detects modification or creation of Group Policy Objects containing logon scripts, consistent with Sinobi domain-wide ransomware deployment
references:

  - https://blog.talosintelligence.com/ir-trends-q2-2026/
logsource:
  product: windows
  service: security
detection:
  selection_gpo_create:
    EventID: 5136
    AttributeLDAPDisplayName: "gPCMachineExtensionNames"
  selection_gpo_modify:
    EventID: 5136
    AttributeLDAPDisplayName|contains:

      - "scriptPath"
      - "gPCUserExtensionNames"
  condition: selection_gpo_create or selection_gpo_modify
falsepositives:

  - Legitimate GPO logon script deployment via approved change management
level: high

title: Zoho Assist Unattended Agent Installation
id: AT-2026-07-28-421-zoho-assist
status: experimental
author: Adverse Trace
date: 2026/07/28
description: Detects installation of Zoho Assist Unattended Agent, consistent with Warlock/Storm-2603 RMM abuse
references:

  - https://blog.talosintelligence.com/ir-trends-q2-2026/
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith:

      - "ZohoMeeting.exe"
      - "ZohoAssistUnattended.exe"
    CommandLine|contains:

      - "install"
      - "unattended"
      - "/silent"
  condition: selection
falsepositives:

  - Legitimate Zoho Assist deployment via approved IT change management
level: medium

7. Sources

• Cisco Talos — "IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains" — https://blog.talosintelligence.com/ir-trends-q2-2026/ — 2026-07-28
• Cisco Talos — "ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365" — https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/ — 2026-07-01
• Help Net Security — "The ARToken phishing panel targets Microsoft 365 accounts" — https://www.helpnetsecurity.com/2026/07/01/artoken-phishing-panel-microsoft-365-accounts/ — 2026-07-01
• The Register — "EvilTokens device-code phishing kit totally more evil than we all thought" — https://www.theregister.com/cyber-crime/2026/07/01/eviltokens-device-code-phishing-kit-totally-more-evil-than-we-all-thought/5265409 — 2026-07-01
• Microsoft Threat Intelligence — "Email threat landscape: Q2 2026 trends and insights" — https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/ — 2026-07-23
• Cisco Talos — "Catan and Mouse" (Threat Source newsletter) — https://blog.talosintelligence.com/catan-and-mouse/ — 2026-07

8. Adverse Trace position

This advisory aggregates three distinct threat clusters from a single quarterly reporting cycle, all of which are directly relevant to EMEA financial services: QR-code phishing bypassing email gateways, device-code phishing defeating MFA via OAuth flows, and ransomware operators weaponising legitimate RMM tooling for stealthy persistence. The ARToken/EvilTokens platform represents a maturation of PhaaS into full BEC operations environments — the 80+ API endpoints and PRT persistence capabilities mean a single successful device-code phish can yield long-term tenant access resistant to password resets. The Sinobi engagement demonstrates a concerning tradecraft combination (trojanized MeshAgent for blended WSS C2, ntds.dit credential extraction, GPO-based domain-wide deployment) that achieved ~3 days of undetected access. All named actors (UAT-11764, Sinobi, Nitrogen, Warlock) lack MITRE ATT&CK profiles — attribution is unconfirmed and rests on Talos IR engagement data alone (single-sourced for Sinobi and Warlock; corroborated by Sekoia and Microsoft for ARToken/EvilTokens). We are treating this as a high-severity advisory for EMEA financial services clients due to the combination of MFA-bypass techniques, trusted-infrastructure abuse, and the demonstrated gap in logging visibility that prevented definitive scoping in 42% of engagements. We will track UAT-11764 QR-code campaign evolution, ARToken infrastructure changes, and any additional Sinobi/Warlock TTP reporting. Clients should prioritise P1 actions immediately — particularly phishing-resistant MFA enforcement, QR-code-in-PDF blocking, and MeshAgent/Zoho Assist hunting.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.