Phishing remained the most common initial access vector for attackers in the third quarter of 2026, according to a new report from Cisco Talos. Ransomware gangs are using voice phishing attacks to trick employees into granting them a foothold within organizations.
“In addition to traditional phishing links and attachments, we observed numerous threat actors conducting voice phishing (vishing) in tandem with IT desk impersonation to socially engineer the victim into allowing remote access via a legitimate remote monitoring and management (RMM) tool,” Cisco Talos says. “Exploitation of public-facing applications was the next most common vector, accounting for one-third of Talos IR engagements. Threat actors predominantly targeted edge devices such as security gateways and remote network management interfaces. These are critical components within enterprise environments, often responsible for managing authentication, network traffic, or sensitive data. Compromising them can provide broad access to internal networks or user credentials.”
The researchers also observed an increase in threat actors abusing AI tools, both as a tool to assist in attacks and as a target for attacks themselves.
“[An] investigation revealed an attack chain in which a compromised macOS endpoint, infected via a trojanized application, was scripted to scrape credentials from the macOS keychain specifically associated with the Anthropic Claude Code AI assistant,” the researchers write.
“This direct targeting of AI-related secrets highlights an emerging threat, where attackers seek to compromise not only traditional user and system credentials but also those tied to AI platforms, which may grant access to additional sensitive data and advanced automation capabilities. These incidents highlight the critical need for organizations to implement strong MFA and robust credential management practices, especially for AI platforms and development tools.”
Cisco Talos has the story: https://blog.talosintelligence.com/ir-trends-q3-2026/
