Phishing and Authentication Abuse Surge in Cybersecurity Incidents

• •Phishing accounted for over 50% of cyber incidents in Q2 2026.
• •Authentication abuse was observed in 65% of incident response engagements.
• •A QR code phishing campaign targeting Microsoft 365 credentials is ongoing.

In Q2 2026, phishing attacks accounted for over 50% of cybersecurity incident response engagements, according to Cisco Talos. This marks an increase from approximately 35% in the previous quarter. Authentication abuse was reported in 65% of engagements, a significant rise from 35% last quarter. Attackers are increasingly using sophisticated methods, including QR code-embedded PDFs and adversary-in-the-middle proxies, to bypass multi-factor authentication (MFA). A notable QR code phishing campaign targeting Australian organizations has been ongoing since April 2026, aimed at harvesting Microsoft 365 credentials. The healthcare sector remains the most targeted industry, followed by public administration and manufacturing. Cisco Talos emphasizes the need for organizations to adopt phishing-resistant authentication methods and enhance visibility across their environments.