Malware

WarLock

Indicators of Compromise 4

Domain m365[.]credential[.]harvesting[.]page Filename rclone.exe Package MeshAgent Package Zoho Assist Unattended Agent

MITRE ATT&CK TTPs 29

Remote System Discovery

Remote Desktop Protocol

Lateral Movement

Lateral Movement

Exfiltration Over Alternative Protocol

Scheduled Task/Job

Indicator Removal

Defense Evasion

Command And Control

Defense Evasion

System Information Discovery

File and Directory Discovery

Account Discovery

Command And Control

Password Spraying

Credential Access

Multi-Factor Authentication Interception

Credential Access

External Remote Services

Exploit Public-Facing Application

Remote Access Software

Command And Control

Domain or Tenant Policy Modification

Defense Evasion

Data Encrypted for Impact

Cloud Service Discovery

Internal Spearphishing

Lateral Movement

Email Hiding Rules

Defense Evasion

Exfiltration Over Web Service

Protocol Tunneling

Command And Control

Multi-Factor Authentication Request Generation

Credential Access

Source Articles

IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

In Q2 2026, phishing remained the dominant initial access vector, accounting for over half of incident response engagements, with attackers increasingly leveraging QR code-embedded PDFs and trusted cloud platforms to bypass defenses. Threat actors, including the newly observed Sinobi ransomware group and Warlock (Storm-2603), weaponized legitimate remote management tools such as trojanized MeshAgent and Zoho Assist for stealthy persistence and lateral movement. Authentication abuse surged, with adversaries bypassing MFA using adversary-in-the-middle proxies, session token theft, and MFA fatigue attacks. The PhaaS platform ARToken was identified, offering a comprehensive toolkit for Microsoft 365 compromise via OAuth-based phishing, highlighting a growing trend in commoditized, sophisticated access-as-a-service operations.