A comprehensive investigation by Prophet Security reveals that identity was the primary target in half of all confirmed malicious activities between May and July 2026, exposing critical flaws in session management.

  • Identity was the target in roughly 50% of all confirmed malicious activity.
  • Session hijacking emerged as the most successful method to bypass security controls.
  • Infostealers delivered via browsers are the primary source of stolen session cookies.
  • Standard Conditional Access policies fail to stop replayed session tokens.

Between May 1 and July 31, 2026, Prophet Security conducted an exhaustive investigation into every alert within customer environments. By eliminating the human analyst's bias in selecting which alerts to investigate, they uncovered a raw dataset where 7% of activity was confirmed as malicious, derived from 4.7 million environment queries.

1. Session Hijacking: The Ultimate Perimeter Bypass

Direct attacks on accounts and sessions constituted approximately 18% of malicious activity. The report highlights a stark contrast: while password-based attacks were largely thwarted by Conditional Access and Phishing-resistant MFA, attacks using already-authenticated sessions succeeded repeatedly.

Read Also:Gundam Rogue Orbit: Bandai Namco Redefines Mecha Combat Beyond Anime Limits

Because a replayed session cookie bypasses the initial authentication phase, no security policies are triggered. This allowed attackers to maintain continuous access to emails for weeks, even after security teams believed the incidents were closed.

Why This Matters

BozokMedia analysis shows that the industry is suffering from an 'Authentication Illusion.' Organizations believe that once a user is MFA-verified, the session is secure. In reality, the session token becomes the new, single point of failure that is easier to steal than a password.

"The shift from password-guessing to session-theft represents a fundamental change in the adversary's playbook, rendering traditional perimeter defenses obsolete."

2. Browser-Based Infostealers

Malicious code execution and tooling accounted for 23% of confirmed threats. Notably, these infostealers were delivered via web browsers rather than email. Attackers utilized compromised legitimate websites, malicious ads, and fake CAPTCHA gates known as ClickFix to bypass automated sandboxing.

Trojanized installers—particularly fake versions of popular AI applications—were common. These tools disabled Windows Defender and established command-and-control channels using payloads like Lumma Stealer, Vidar, and AsyncRAT.

Did You Know?: The 'ClickFix' technique forces a human interaction (a click), which tricks many automated security scanners into thinking the activity is legitimate and safe.
Attack Vector Security Response Outcome
Password-based Conditional Access/MFA Usually Blocked
Session Hijacking Standard Auth Checks Often Successful
MFA Fatigue User Approval Successful (if user complies)

Frequently Asked Questions

Q1: What is Session Hijacking?
It is the act of stealing a session cookie from a browser, allowing an attacker to impersonate a user without needing a password or MFA.

Q2: How can organizations prevent Infostealer attacks?
By implementing stricter browser security policies, educating users on 'ClickFix' scams, and using phishing-resistant hardware keys.