Adaptive intrusion workflows: what security teams need to watch

TL;DR: Attackers are combining ClickFix, rogue RMM, blockchain-based command and control, and AI-managed exploitation to keep campaigns moving while changing infrastructure and payloads, according to Blackpoint Cyber’s September analysis. The implication is clear: defenders need behaviour-based detection and response that outlasts domains, binaries, and workflow masquerading.

Editorial analysis by NHI Mgmt Group, based on content published by Blackpoint Cyber: “Notes from the Chief Security and Trust Officer: September 2026”.

Key questions

Q: What breaks when attackers use trusted authentication flows for initial access?

A: Traditional password-centric controls break because the login itself is no longer the malicious act.

Q: Why do adaptive intrusion campaigns increase identity and session risk?

A: They increase identity and session risk because once attackers obtain browser credentials, tokens, or remote access footholds, they can keep moving even when the original payload changes.

Q: What are the signs that command and control is being resolved dynamically?

A: Look for implants that fetch tasking or panel addresses at runtime, especially when the destination changes without a new payload build.

Practitioner guidance

• Hunt for trusted-workflow abuse Correlate ClickFix-style user interaction, rogue RMM installs, and unusual Run dialog activity with subsequent process creation and network egress.
• Prioritise runtime C2 detection Detect malware that resolves tasking dynamically through smart contracts, DNS lookups, or other runtime indirection rather than static destinations.
• Expand identity telemetry around browser and session artefacts Watch for browser credential theft, token use, possible PRT access, and anomalous sign-ins that follow remote-access or social-engineering chains.

Bottom line: Attackers are increasingly combining trusted workflows, remote administration abuse, and dynamic command infrastructure to make intrusions harder to pin to a single indicator.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →