GoKawiilProphet Security: Identity attacks drove half of confirmed threats in Q2 2026
Prophet Security analyzed every alert across customer environments from May to July 2026, rather than only alerts analysts chose to escalate. Of the incidents fully investigated, 93% were benign and 7% were confirmed malicious, with identity-related attacks accounting for roughly half of that malicious activity. The firm identified session hijacking, token replay, MFA bypass, credential stuffing, and phishing as the dominant attack patterns.
GoKawiil's interpretation of the reporting above, not reported fact.
The data suggests that whether an attacker uses a stolen password or an already-authenticated session is the single biggest factor separating a blocked attempt from a successful breach, which sharpens where defenders should focus hardening efforts. Because the study covers all alerts rather than a human-filtered subset, it offers a rare unbiased view of what attacks actually look like versus what security teams typically choose to escalate.
- Identity-based attacks made up about half of all confirmed malicious activity in the quarter.
- Session hijacking and token replay were more effective than password-based intrusion attempts, which conditional access and phishing-resistant MFA often blocked.
- Investigating every alert, not just analyst-selected ones, revealed patterns hidden in typical threat datasets.
Yubico YubiKey 5 NFC Security Key — When identity is the target in half of confirmed attacks, phishing-resistant hardware MFA is the practical answer. The YubiKey 5 NFC plugs into USB-A or taps NFC-enabled phones and works with major account providers and password managers, so stolen passwords alone won't get an attacker in.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-10
Published there as: “The Top 4 Threats We Found by Investigating Every Alert for a Quarter”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.