Attackers Used Social Engineering in 47% of Breaches, Microsoft Finds

The most common way criminals broke into companies last year wasn't through technical exploits—it was by simply asking people to run malicious commands themselves. A technique called ClickFix, which tricks visitors into copying and pasting commands into their own terminals, accounted for 47% of initial access attacks observed by Microsoft's security team in 2025, according to a new analysis published by The Hacker News on September 1, 2026. The report argues that cybercriminals aren't pursuing more sophisticated methods because they don't need to—they're running standardized playbooks that work reliably across thousands of targets.

The data shows attackers increasingly favor methods that scale over those that require skill. Verizon's latest Data Breach Investigations Report found that exploiting known vulnerabilities became "the most prominent initial access vector" at 31%, climbing from 20% the previous year—a 55% jump in twelve months. When Bitdefender examined 700,000 security incidents, 84% of high-severity cases involved legitimate system binaries already installed on victim machines rather than malware introduced by attackers. Meanwhile, ransomware activity surged to 48% of all breaches, up from 44% the year before, yet the median ransom payment dropped to $139,875 from $150,000. Bitdefender's tracking of ransomware leak sites counted 704 organizations listed as victims in June 2026 alone—more attacks yielding less money per incident.

The report highlights how criminal groups now operate like franchise businesses, prioritizing repeatable procedures over custom attacks. The appeal of ClickFix lies in its reliability: there's no payload to rebuild when defenses improve and no exploit to redevelop when vendors patch vulnerabilities. When a lure stops working, attackers just rewrite text on a webpage. The so-called "living off the land" approach follows the same logic one step further—operators use scripting engines, remote management utilities, and administrative tools that ship with every operating system, so an operator who learns the sequence once can run it at the next victim without adaptation. The report notes that top ransomware groups like The Gentlemen, which claimed 121 victims in June versus runner-up Qilin's 80, branched out from former affiliates and succeeded by recycling proven playbooks rather than inventing new techniques.

The report explains why attackers won't rush to adopt AI despite the hype: autonomy contradicts the economics of volume crime. An autonomous agent improvises a different path through each victim's environment, which is exactly the opposite of what franchise-model ransomware needs. The entire affiliate model depends on procedures that produce identical results in unfamiliar hands—variance makes training impossible and outcomes unpredictable. More fundamentally, the current playbook approach costs almost nothing per attempt because scanning is cheap, exploits arrive free from researchers on GitHub, and tools are already on victim machines. Putting a model in that loop adds real cost to every attempt, in a business that has spent years driving per-attempt costs toward zero. The report recommends defenders focus on the handful of doors these standardized playbooks actually use: patch internet-facing systems with remote code execution vulnerabilities before working proof-of-concept code appears on GitHub, restrict who can invoke built-in scripting and remote management tools, and deploy detection that someone is actually monitoring. In Bitdefender's own incident response investigations, the same two findings recur: either no endpoint detection was deployed at all, or it was deployed but nobody was watching the alerts. Organizations defending against unlimited creativity would face an impossible task, but standardized attacks create standardized defense problems—close the small number of doors the playbook requires, and it can't be economically redesigned for every victim. The business model that makes these attacks cheap to run also makes them brittle when the procedure breaks. The friction that slows enterprise security decisions—approvals, budgets, coordination across teams—often feels like a disadvantage against fast-moving adversaries, but it creates asymmetric leverage when defenders target the specific choke points that attackers can't afford to redesign at scale.