Hackers Are Hiding Inside the Work Tools Your Business Already Trusts

Security company Huntress has ranked the attack methods hurting businesses most, and the pattern is clear. Attackers are less likely to use flashy malware. They hide inside tools and logins that a company already trusts. In the first quarter of 2026, 45% of the computer-level incidents Huntress investigated involved misuse of remote IT tools.

What Huntress found

Remote monitoring and management tools, known as RMM, let IT staff control computers from afar. That is why attackers like them. One rogue install gives lasting access that looks like routine admin work. Huntress says attackers also use AI to build convincing fake document shares and service agreement emails that trick people into installing these tools.

The second problem is mailbox tampering. So far in 2026, 24.6% of identity threat signals Huntress tracked pointed to it. Once inside a mailbox, an attacker can set rules that send vendor replies to folders nobody checks, such as RSS Feeds or Archive. They can then change invoice details and redirect payments to their own accounts. No malware is involved, so there is nothing for security software to flag.

The third is a fake-login attack. The attacker sits between the victim and the real Microsoft 365 sign-in page and copies the session token, the digital pass that keeps you signed in. Nothing looks wrong to the user. While that session stays valid, the attacker gets in without a password or a new MFA prompt. These attacks made up 18.9% of identity-based threats Huntress tracked in 2025.

Newer tricks to watch

• Device code phishing: a prompt has you type a short code on a real Microsoft page. The attacker gets a token that can outlive a password reset. The EvilTokens kit hit 344 organizations in five countries in 16 days.
• ClickFix: a fake CAPTCHA or error message gets someone to paste a harmful command. It is about 2.2% of Huntress endpoint detections in 2026, but nearly 99% of those were high severity.
• Fake AI tools: FakeAgent used a malicious Claude Artifact on the real claude.ai domain to steer people hunting for Claude Desktop to SectopRAT malware. It reached 29 organizations in two days.

What to do

Huntress suggests starting with the top threats and asking two plain questions. Which remote tools has IT approved? How would we catch mailbox rule changes and strange sign-in behavior early? Any remote tool not on the approved list deserves a closer look. So does any inbox rule nobody remembers creating.

Staff can help too. Be wary of unexpected prompts to enter a device code. Never paste a command into a terminal because a web page asked you to. Download software only from the official source.

A note on the numbers

The figures come from Huntress, which sells security services, and reflect cases it investigated or tracked. They are not a count of every attack everywhere. They do show which tricks it sees often, and where a small business is most likely to be caught off guard.