Topic starter
11/06/2026 10:47 pm
TL;DR: Identity-based attacks rose 32% last year, 97% were password-based, and ClickFix accounted for 47% of observed initial access, according to Microsoft and CrowdStrike data cited by Push Security. Browser-native phishing, malicious extensions, and help desk scams now target identity controls directly, not just endpoints.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “Taking the fight to attackers: Pushâs top features of 2025”.
By the numbers:
- Identity-based attacks surged by 32% over the last year, according to Push Security.
- 97% of identity attacks were password-based, driven by a combination of credential leaks and infostealer malware, according to Push Security.
- ClickFix was the most common initial point of access for adversaries in the past year, accounting for 47% of observed attacks, according to Push Security.
Key questions
Q: What breaks when identity controls stop at the endpoint and ignore the browser session?
A: Browser-native attacks can complete authentication, steal tokens, and trigger consent without host-level malware or suspicious process activity.
Q: Why do browser-based phishing attacks increase account takeover risk so quickly?
A: They compress the gap between lure, credential capture, and session abuse.
Q: How do organisations reduce the blast radius of stolen non-human credentials?
A: Organisations reduce blast radius by shortening credential lifetime, limiting assigned permissions, and correlating each access event to a specific workload or agent context.
Practitioner guidance
- Strengthen browser-side identity telemetry Collect signals from browser sessions, not just IdP logs, so you can see phishing lures, credential entry, clipboard events, and OAuth consent abuse as they happen.
- Eliminate ghost login pathways Find business apps that still accept local passwords or unmanaged authentication paths and convert them to federated sign-in wherever possible.
- Map password reuse blast radius Identify applications that share the same password set and revoke or reset credentials where one compromised account could unlock several systems.
Bottom line: Browser-based identity attacks are no longer edge cases, and they work because they exploit trusted user workflows rather than obvious malware paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:07 am
The browser is now an identity control plane, not just an endpoint surface. Push Security’s analysis shows that attackers increasingly exploit trusted web contexts, federated login flows, and browser-side interactions to defeat controls that were designed around email or network perimeter assumptions. That changes the governance boundary for IAM teams, because identity assurance now depends on what happens inside the browser session as much as what happens at the directory. The practical conclusion is that browser telemetry belongs in identity security architecture, not as an optional add-on.
A question worth separating out:
Q: How should teams verify users in help desk workflows without creating new bypasses?
A: Use a verification step that is difficult for attackers to satisfy through social engineering alone and require it before resets or recovery actions. Help desk staff should not rely on call familiarity or partial profile data. The goal is to protect the account state change, not just the conversation.
👉 Read our full editorial: Browser-based identity attacks are reshaping enterprise IAM
This post was modified 1 day ago by NHI Mgmt Group