HP Inc. Threat Insights Report Exposes Rise in Attacker Reliance on Legitimate Software and Deceptive Phishing
HP Inc. has released its latest Cyber Threat Insights Report, tracking an increasing reliance by threat actors on legitimate software, cloaked malware, and highly convincing social engineering tactics to compromise user endpoints. The report highlights a growing challenge for both everyday users and cybersecurity teams, as malicious activities seamlessly blend into routine, lawful digital operations to bypass traditional detection mechanisms.
Drawing from data captured across millions of endpoints secured by HP Wolf Security, threat researchers identified several prominent corporate cyber campaigns during the January–March 2026 period, including:
Exploiting Legitimate Remote Access Tools (RATs) as Backdoors: Cybercriminals are abusing trusted remote desktop applications, such as LogMeIn and ScreenConnect, to hijack victim devices undetected. These campaigns typically originate from tax year-end phishing lures or malicious links hosted on fraudulent websites, including fake dating portals. Once installed, attackers utilize these legitimate tools to maintain persistent infrastructure access under the guise of routine technical tasks.
Targeting Crypto-Asset Recovery Seekers: Threat actors are distributing fraudulent scripts on code-sharing repositories and media download hubs, masquerading as recovery tools for lost digital wallets. These scripts, often peppered with emojis, indicate an increased reliance on Generative AI for malware development. The software harvests sensitive user credentials, system data, and wallet credentials before exfiltrating them in archived formats.
ClickFix Campaigns Masking Malware as Audio Files: Attackers are masquerading malicious software as routine audio files to evade scanning engines. Victims are guided through highly polished, realistic CAPTCHA verification prompts on spoofed websites, which triggers background executable commands that execute malware silently.
Patrick Schläpfer, Principal Threat Researcher at HP Security Lab, commented: "What distinguishes these campaigns is how seamlessly attackers weaponize legitimate remote access utilities into entry points. By fusing trusted software with carefully tailored social engineering tied to seasonal events like the tax year-end, distinguishing between benign and high-risk activity has become exceptionally difficult."
By isolating payloads that evade gateway filters and executing them safely within isolated micro-virtual machines, HP Wolf Security gains deep visibility into advanced cybercrime mechanics. To date, HP Wolf Security users have interacted with over 60 billion email attachments, web pages, and downloads with zero reported breaches.
The report's statistical breakdown for Q1 2026 underscores the diversification of modern threat vectors:
At least 11% of email threats identified by HP Sure Click had successfully bypassed one or more secure email gateway filters.
Executables remained the primary malware delivery mechanism at 39%, followed closely by Archive files at 38%, and PDF documents at 10%.
PDF-based attacks saw a 2% increase, with threat actors deploying diverse lures—ranging from legal documents to monetary rewards—to induce unverified user clicks.