Report | Cyber Security Report, 2026 | Check Point Software

Report | Cyber Security Report, 2026

ANNULEDITION14thCYBER SECURITYREPORT 2026

TABLE OF CONTENTS:

01 INTRODUCTION

LOTEM FINKELSTEIN, VP Research
In 2025, the threat landscape evolved rapidly, becoming more interconnected and challenging to manage. Our analysis of global telemetry and incidents reveals a fundamental shift, marked by the emergence of new attack surfaces and techniques. Attackers are integrating AI, identity abuse, exposure exploitation, and ransomware into their campaigns. The most significant change is the accelerated pace and scale at which attack opportunities are being executed. Data indicates that attackers are linking access, execution, and impact across various domains, from AI-driven social engineering and automation to the transformation of ransomware into a data-driven extortion economy. Edge devices and exposed infrastructure are increasingly used as launch points. These patterns were consistently observed across regions and industries in 2025, highlighting the swift combination of techniques to create tangible impacts. AI exemplifies this transformation. This report views AI as a force multiplier that enhances targeting, scale, and adaptation in attacker activities, while also influencing risk prioritization and operational responses. Our report is structured around attacker behavior and real-world data. The subsequent chapters delve into where attackers are focusing their efforts, how different techniques reinforce each other, and which exposure patterns most frequently lead to impact. This provides the necessary context to understand the trajectory of the threat landscape and what will be most critical in 2026. I invite you to explore the data and findings presented in this report.

02 CYBER SECURITY TRENDS

BEYOND EMAIL: MULTI-CHANNEL SOCIAL ENGINEERING

Which attack surface is the easiest to exploit across all organizations? For attackers in 2025, the answer was the human component. In social engineering attacks, threat actors attempt to do just that: achieve compromise by manipulating human victims into providing the initial access for them. In such attacks, threat actors target employees, outsourced personnel, and third-party service providers to gain access to the organization’s systems or sensitive information. Although these attacks are perceived to be less serious than those exploiting software or hardware vulnerabilities, they can be just as damaging as compromises achieved through other means.

For years, phishing emails served as the primary social engineering vector, and organizations became increasingly aware of these threats. However, by 2025, social engineering expanded beyond traditional email-based campaigns, adopting multi-platform, cross-channel, and highly targeted approaches that leverage phone calls, messaging applications, and real-time impersonation. At the same time, attackers have evolved how email and browser-based social engineering attacks are executed, shifting toward interaction-driven techniques such as ClickFix and its variants. These methods guide users through seemingly legitimate workflows designed to bypass security controls and inadvertently execute malware. These approaches have resulted in millions of compromise attempts worldwide and contributed to several high-impact business breaches, resulting in significant financial losses for enterprises globally.

ClickFix: Social Engineering That Shifts Execution to the User

ClickFix emerged as one of the most significant social engineering techniques in 2025. First observed in 2024, ClickFix is an initial access method in which attackers manipulate users into executing malicious actions by presenting them with fraudulent instructions. These instructions, typically delivered through compromised or attacker-controlled websites, malvertising, or brand-impersonation emails, are crafted to resemble routine verification steps such as CAPTCHAs, validation checks, or error fixes. By appearing as legitimate steps required to continue normal activity, users are manipulated into running attacker-controlled content that ultimately delivers malware.

Figure 1: Flowchart of a ClickFix attack

This technique succeeds by exploiting user trust and the tendency to follow technical instructions. It has proven highly effective due to its simplicity, scalability, and ability to bypass certain security controls, as malicious actions are executed manually by the user rather than delivered through traditional file-based infection chains. As a result, its adoption has accelerated rapidly. In 2025, ClickFix activity increased by approximately 500% compared to the previous year and was observed in nearly half of all documented malware campaigns. The technique has been widely adopted across the threat landscape, including by established cyber criminal groups behind major infostealer operations, such as RedLine and Lumma, and in attacks that delivered payloads leading to Interlock ransomware infections.

The popularity of ClickFix and its variants in 2025 has spread beyond Windows environments. Threat actors developed campaigns specifically targeting macOS users, as well as advanced threats that use ClickFix techniques to target Linux systems. As we saw with phishing kits, ClickFix began to commoditize by creating kits such as the IUAM ClickFix Generator, which enables attackers to create highly customizable, cross-platform ClickFix campaigns and rapidly adopt the technique at scale. Coercing victims to initiate malicious activity on their own systems reflects a broader shift in attackers’ social engineering strategies, which abuse user trust in legitimate processes across endpoints, browsers, and cloud identity platforms.

Voice-Based Social Engineering – The Weapon of Choice for Major Attacks

Voice phishing and impersonation gained significant traction in 2025, proving to be a highly effective means to exploit user trust. In these attacks, threat actors pose as trusted or authoritative figures and, following targeted reconnaissance, use rehearsed scripts to pressure victims to take actions such as resetting credentials, changing MFA codes, or granting network access. Historically associated with low-complexity consumer fraud, phone-based impersonation has evolved into an enterprise-focused intrusion technique used to gain an initial foothold in large organizations. In 2025, voice-based impersonation became a preferred technique among highly sophisticated threat groups targeting major brands.

Most notably, this activity was associated with financially motivated threat actors such as Scattered Spider and the cluster commonly referred to as Scattered LAPSUS$ Hunters (SLH). Scattered Spider (also tracked as UNC3944 / Octo Tempest) is a highly effective, intrusion-focused cluster known for identity-centric initial access techniques, including help desk and IT vendor impersonation, MFA fatigue, and SIM-swap account takeover.

In 2025, voice-driven social engineering emerged as a primary initial access vector in high-impact enterprise breaches, enabling data theft and extortion.

The expanded use of voice impersonation to target both individuals and high-profile enterprises is one of the defining social engineering trends of 2025, with several high-impact campaigns causing substantial financial and operational damage to affected organizations.

Victim-Initiated Social Engineering

In 2025, we observed a growing trend of victim-initiated (inbound) social engineering, where attackers deliberately steer targets into initiating contact, thereby increasing the perceived legitimacy of the interaction. This approach prompts employees to initiate follow-up correspondence with the attackers. The attackers then engage victims in weeks-long email exchanges before delivering a malicious ZIP attachment that deploys malware.

Threat actors are increasingly expanding social engineering activity beyond email to messaging on social media platforms and messaging apps, where user expectations and security controls are often weaker. This shift reflects a broader trend toward exploiting communication channels that fall outside traditional corporate security monitoring.