Q2 IR: Phishing and RMM Abuse Lead Attack Chains
Talos IR's Q2 2026 report finds phishing dominant for initial access, with legitimate RMM tools displacing custom malware as the persistence mechanism of choice.
Dave "Kilobaud" Ferris Talos Intelligence published its Q2 2026 IR Trends report today. The two headlines: phishing remains the dominant initial access vector, and legitimate remote monitoring and management tools have displaced custom malware as the preferred persistence mechanism across a significant share of cases.
Neither of these is new. Phishing has led the initial access charts long enough that its persistence there feels less like a security failure and more like a structural feature of the problem. RMM tool abuse isn’t new either — using ConnectWise, Level, AnyDesk, or TeamViewer to maintain persistence rather than writing custom implants is a technique documented for years. What the Q2 data is telling us is that both trends are accelerating, and that acceleration is the signal worth attending to.
The RMM abuse piece is worth dwelling on. These tools are trusted by design. Enterprise IT deploys them at scale; they provide persistent remote shell access, file transfer, and session control — the exact capabilities an attacker needs — through channels built to look like normal IT activity. An RMM agent installed by an attacker generates the same telemetry as one installed by the helpdesk. Endpoint detection tuned for malware signatures doesn’t know the difference.
Operation BlueDash demonstrated this in practice last week: a phishing campaign using a counterfeit Microsoft Teams update page, delivering Level RMM and ScreenConnect. Not custom malware. Legitimate tools running on attacker-controlled infrastructure. The Q2 Talos data suggests that case is representative, not exceptional.
The phishing angle compounds this. If initial access comes via phishing and the persistence mechanism is a legitimate tool, your detection chain needs to catch the phishing before the foothold is established — because catching the RMM installation after the fact depends on knowing that agent wasn’t supposed to be there in the first place. Many organizations don’t have a clean inventory of which RMM agents are running in their environment. That is the gap, and it is not a technical one.
Q2 also brought substantial growth in CVE volume, roughly 200 new CVEs published per day on average. The IR cases Talos documents are mostly not zero-days. They’re phishing followed by a well-understood post-compromise toolkit. The sophistication is in the operational choices, not the technical primitives. Defenders who spend the majority of their attention on vulnerability counts are measuring the wrong thing.
Two practical checks the Q2 findings point toward:
Audit your RMM inventory. Know what remote access tools are deployed, where, and via what process. Anything that doesn’t trace to an authorized deployment is worth treating as an incident rather than an anomaly to investigate slowly.
Phishing resistance is a program, not a training module. If phishing is the primary entry point across the majority of IR cases, the answer isn’t more awareness posters. It’s layered controls — MFA resistant to real-time phishing (passkeys, hardware tokens), conditional access policies, and detection tuned to flag suspicious logins that followed a credential event.
The Q2 patch prioritization findings published earlier this month are part of the same picture: you can’t outpatch the volume, and most attackers aren’t using novel vulnerabilities to get in anyway. The entry point is still a clicked link. That is the thing worth fixing.
Found this useful? Share it.
