IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

Key Takeaways

• Phishing was the primary means of gaining initial access this quarter, appearing in over half of all Cisco Talos Incident Response (Talos IR) engageme.
• Attackers continued to innovate their delivery methods to evade defenses, deploying QR code-embedded PDFs to bypass traditional email gateways and hos.