Phishing, password theft and ClickFix dominate observed intrusions

Phishing, password theft and ClickFix are the most common intrusion methods observed by Microsoft and ENISA. Microsoft’s Digital Defense Report 2026 found that phishing is the most common entry point for cyber attackers, followed by exploiting exposed applications and using valid accounts. ENISA’s Threat Landscape 2026 report found that phishing represents 77.8% of social engineering techniques used in incidents targeting the EU. ClickFix, a technique that tricks victims into fixing a fake problem, has seen a 23-fold increase in attacks between December 2025 and May 2026. Microsoft notes that these methods rely on the reaction of victims, who often lack proper protection measures. ENISA’s report also highlights the increasing use of ClickFix and the importance of proper identity governance and authentication measures.