From stolen passwords and hijacked RMM tools to hidden email rules and ClickFix social engineering, modern cyber threats rarely start with flashy exploits — they start with valid credentials and trusted tools.
More tools. More alerts. More late nights. And yet, the incidents that keep blowing up your week rarely start with some flashy, sophisticated exploit. They start with a login that 'looks fine,' a remote tool your team already trusts, or a user who thinks they're just pasting a command to 'fix' their browser.
Across the environments we watch, the common thread isn't 'a scary new piece of malware.' It's the same handful of behaviors, dressed up differently each time: ransomware starting with a password, email compromises that never touch a device, everyday IT tools turned against you, employees tricked into running payloads, and disconnected log signals that hide brute-force attacks.
Attackers don't have to break in if they can log in. Identity has become the new front door they can walk right through using usernames, passwords, sign-ins, and mailbox permissions.
1. Ransomware That Starts With a Password, Not a Virus
Most ransomware attacks today don't start with someone clicking a malicious attachment. They start with an attacker who already has a working username and password, and simply logs in like anyone else.
In one case involving a manufacturing company, the attacker was already inside the network by the time anyone noticed anything wrong. Once they had a valid login, they used the same everyday tools IT teams use to manage a network — remote access software and built-in Windows admin tools — to move machine to machine, quietly turning off security protections and mapping out the network along the way.
This is the pattern in identity-led ransomware: 1) Steal or reuse a valid login, 2) Move machine-to-machine using built-in admin tools, 3) Grab passwords and map the network, 4) Quietly install remote-access software for long-term access, 5) Trigger ransomware encryption 20+ hours later.
Why it's easy to miss: The 'break-in' is just a normal-looking login. The tools used to move around are the same tools your own IT staff uses every day. Nothing looks like malware until encryption starts.
What to watch for: Admin or service accounts hopping between machines unexpectedly, registry changes, or new remote access tools installed in unusual paths.
2. Email Attacks Where the Mailbox Becomes the Malware
This is a version of business email compromise (BEC) where the attacker never installs anything or touches a device at all. The entire attack happens inside someone's email account.
An attacker gains access to a Microsoft 365 account, quietly sets up inbox rules to redirect or hide emails in folders like 'Conversation History', and monitors ongoing conversations around invoices and payments without the employee noticing.
Why it's easy to miss: Standard endpoint tools don't see any of this because there is no file or device involved. Logins from unusual locations can look like normal remote work.
What to watch for: New inbox rules that quietly move or hide mail (especially payment-related), and logins to sensitive accounts from unusual devices or locations.
3. When the IT Tools You Trust Get Turned Against You
Today's attackers don't need special hacking tools. They weaponize the admin tools your IT team already trusts: RMM, remote support, and software deployment tools.
In a recent Qilin ransomware incident, attackers installed remote access software disguised with a name almost identical to a legitimate tool to blend in with normal IT activity. Through that connection, they pulled in credential stealers and disabled antivirus protection.
Why it's easy to miss: Remote management tools are explicitly allowed on purpose. Activity from these tools looks nearly identical whether it's legitimate IT staff or an attacker behind the keyboard.
What to watch for: New or renamed RMM installs that don't match your standard stack, installer paths impersonating legitimate products, and security settings disabled around the time remote tools appear.
4. When the User Is Tricked Into Running the Payload for You
A social engineering trick (sometimes called 'ClickFix') convinces victims to copy a command and paste it into Windows Run (Win+R) or PowerShell themselves. In the logs, it looks like an intentional user command rather than an external exploit.
Victims searching for free tools or reading online prompts are instructed to copy and paste code to 'fix' a browser error or complete a verification. Running it triggers automated scripts that steal saved passwords, browser data, and session tokens.
Why it's easy to miss: No file was downloaded by a browser, so web filtering and file scanning miss it. The command runs with the user's own permissions.
What to watch for: Employees using Windows Run (Win+R) right before unusual network activity, or execution of scripts from temp folders.
5. Disconnected Threat Signals: When 'Noisy' Brute-Force Becomes the Real Story
Individually, failed logins or blocked remote desktop attempts look like routine noise. But when correlated across multiple systems (VPNs, M365, RDP), they reveal targeted password spraying or credential stuffing.
By stitching together contextual signals across endpoint and identity telemetry, security teams convert thousands of background logs into actionable threat intelligence.
Why it's easy to miss: Isolated log events get buried in daily noise. Without unified detection across identity and endpoint, the broader attack pattern stays hidden.
What to watch for: The same IP or device attempting logins across multiple services, or a sudden spike in failed logins followed by a success on an unmonitored account.
Identity Is the New Endpoint
Look back at all five threat patterns: ransomware via stolen login, BEC via mailbox settings, hijacked IT tools, user-executed payloads, and correlated brute force. Identity is the common denominator.
That's why security must protect which accounts can authenticate, what happens when mail rules change, which devices connect, and which trusted tools are allowed to run.
This article is an attributed reprint from Huntress. Reproduced for our readers with credit to the original author.