Attackers turn trusted tools into cyber weapon
What happened
ClickFix, a social engineering technique that tricks users into running malicious commands themselves, featured heavily in defence evasion activity and was linked to more than 44% of incidents in that category. ConnectWise ScreenConnect led RMM-related incidents at 25%, but the pattern differed from the usual use of such tools after an attacker had already gained control of a network. This matters for IT, Telecom & Cyber because capacity and lead-time signals can move supplier prioritization, award timing, and contingency lanes with 40.9, 44, 27.3 as the clearest commercial anchors; buyers should plan for renewal uplift asks
Buyer takeaway
For IT, Telecom & Cyber, this is a staffing-shape signal: remote operating models can shift work offsite and change which suppliers, systems, and service levels matter most
Cost / money
The cost angle is directional, not quantified: moving work offsite can cut travel, rotation, and accommodation exposure, but only if the remote setup stays reliable
Supplier / commercial
Expect scope to move toward software support, communications uptime, cyber obligations, and clearer downtime liability instead of only offshore headcount or hardware supply
Safety / operations
Fewer people offshore can reduce exposure and emergency-response load, but the operating model becomes more dependent on connectivity resilience, remote support readiness, and cyber hygiene
What to watch
Watch bandwidth resilience, latency tolerance, cyber obligations, and who carries downtime cost if the remote link drops
Key facts
- ClickFix, a social engineering technique that tricks users into running malicious commands th
- ConnectWise ScreenConnect led RMM-related incidents at 25%, but the pattern differed from the
- 7% of RMM-related incidents and was linked to exploitation of CVE-2026-1731, a critical remot
- 1% of victims named on data-leak sites tracked by ReliaQuest, while Akira accounted for 10
