Vega Quarterly Threat Report, Q2 2026
Over the past quarter, threat actors kept favoring techniques that are fast to deploy, easy to adapt, and hard for traditional prevention controls to stop: ClickFix lures in more than half of Vega customer environments, compromised npm packages inside routine developer workflows, cloud and identity abuse through valid access paths, and exploitation of CVE-2026-22679 days after the patch. Vega Threat Research reports what we saw, what it means, and the detections that caught it.
What's inside
Executive summary: the operational efficiency of modern attacks and the five themes that shaped Q2. Threat landscape: one-day exploitation, ClickFix initial access, cloud and identity abuse, ransomware crews (Qilin, The Gentlemen, Akira), network-edge targeting, and npm supply-chain compromise. Notes from the trenches: seven incident patterns Vega investigated, from WDigest tampering to anti-forensic deletion. Detections we loved: twelve behavioral signals across endpoint, cloud, identity and the developer environment. Summary: why incidents are connected attack paths and identity is the thread.