The most damaging cyber attacks often exploit the tools and workflows that organizations already rely on, rather than making headlines with novel exploits. For small and mid-sized businesses managing their own IT or working with managed service providers, staying ahead of attackers requires knowing which tactics pose the greatest risk and where to direct limited security resources.

The Tragic Quadrant Framework

Huntress developed the Tragic Quadrant as a prioritized ranking of cyber tactics threatening businesses, designed to guide defense decisions independent of weekly threat trends. The framework identifies which attacks merit immediate attention and which require monitoring for future escalation.

Figure 1: The Huntress Tragic Quadrant
Figure 1: The Huntress Tragic Quadrant

Critical Threats Requiring Immediate Action

The highest-priority threats operate within tools and systems teams use daily, from remote access platforms to cloud authentication services.

RMM Abuse Remains Persistent

Remote monitoring and management tools provide attackers with persistent access that mimics legitimate administrative activity. During Q1 2026, RMM abuse appeared in 45% of endpoint incidents investigated by Huntress. Attackers are leveraging AI to generate convincing fake document shares and service agreements that lure users into installing unauthorized RMM software.

Mailbox Manipulation Enables Business Email Compromise

Mailbox manipulation and persistence accounted for 24.6% of Identity Threat Detection and Response signals tracked by Huntress through 2026. Once attackers gain mailbox access, they can modify inbox rules to hide vendor communications in folders like RSS Feeds or Archive, then alter invoice details and redirect payments without triggering malware detection.

Adversary-in-the-Middle Attacks Bypass MFA

Adversary-in-the-middle attacks represented 18.9% of identity-based threats tracked by Huntress during 2025. In these attacks, an attacker intercepts traffic between a user and the legitimate Microsoft 365 login page, captures the session token, and forwards the connection onward so the user sees no disruption. With a valid session, the attacker maintains account access without needing a password or triggering a fresh MFA challenge.

Emerging Threats Requiring Monitoring

Beyond the top-priority tactics, three additional threat patterns are evolving and could escalate toward critical status.

Figure 2: Phishing links wrapped in legitimate Cisco, Trend Micro, and Mimecast redirects, with token-harvesting infrastructure hosted on Railway.
Figure 2: Phishing links wrapped in legitimate Cisco, Trend Micro, and Mimecast redirects, with token-harvesting infrastructure hosted on Railway.

Device Code Phishing Exploits Legitimate Login Flows

Device code phishing is less widespread but leverages Microsoft's legitimate device code authentication flow, making traditional URL inspection ineffective. Attackers present convincing prompts that convince users to enter a short code on a genuine Microsoft page, yielding an access token that persists even after password resets. A phishing-as-a-service platform called EvilTokens targeted 344 organizations across five countries within a 16-day period. Security teams should flag unusual device code prompts and suspicious token activity.

Figure 3: A pasted command in the Windows Run box leads to a LummaC2 infostealer compromise.
Figure 3: A pasted command in the Windows Run box leads to a LummaC2 infostealer compromise.

ClickFix Exploits Routine User Behavior

ClickFix preys on the copy-paste reflex users develop to bypass everyday friction. Fake CAPTCHA or "verification failed" messages trick users into pasting malicious commands into their terminal, with the paste action itself executing the code and bypassing the need for a traditional exploit chain. The attack can deliver infostealer malware or ransomware. Through early 2026, ClickFix accounted for approximately 2.2% of Managed Endpoint Detection and Response signals, with nearly 99% of those detections flagged as high severity.

AI Platform Abuse Remains Nascent

Figure 4: FakeAgent hosted a malicious Claude Artifact on the real claude.ai domain to spread SectopRAT.

This threat category sits in the overhyped corner because the pattern is still emerging. Attackers embed malicious content within AI tools and workflows that users trust, such as a fake "desktop client" or "productivity helper" hosted within a shared conversation or artifact on legitimate AI domains like Claude or ChatGPT. In one incident, FakeAgent deployed a malicious Claude Artifact on the real claude.ai domain to redirect users seeking Claude Desktop toward SectopRAT, compromising 29 organizations within two days.

Applying the Framework to Your Environment

The Tragic Quadrant serves as a starting point for prioritizing defenses when multiple threats demand attention. Begin by examining the highest-priority corner: which remote tools have approval, and how can teams detect mailbox rule changes and unusual session behavior before they escalate into breaches?