Microsoft’s latest Digital Defense Report shows cyberattacks getting faster, more connected, and harder to spot, even as attackers continue relying on some very familiar ways into a business. We’re looking at the report’s biggest findings and what they could mean for your business as we sit down and sync up with Rocket IT’s weekly technology update.

In this episode, you’ll learn more about:

• How familiar attack methods are becoming faster and harder to recognize.
• Why people and legitimate accounts remain common ways attackers gain access.
• How phishing, QR codes, impersonation, and Teams calls are being used to blend into everyday work.
• Why quickly patching exposed systems can reduce the window attackers have to exploit them.
• How AI is accelerating existing threats and why resilience matters when something goes wrong.

Video Transcript

Microsoft’s 2026 Digital Defense Report looks primarily at security activity from July 2025 through June 2026, and one of its biggest themes is that cyber risk is becoming more interconnected. If an attacker gets access to one account, device, cloud service, or trusted business tool, that foothold can sometimes open a path to other parts of the organization.

What stands out is that even with all the changes happening in cybersecurity, many attacks are still starting in familiar ways. Microsoft continues to see attackers targeting people and legitimate accounts by tricking someone into taking an action, stealing access to an account, or making something malicious look like part of a normal business interaction.

ClickFix is a good example. Someone may see a fake CAPTCHA, browser message, or verification prompt telling them to copy and paste a command into Windows. The instructions can look like they’re fixing a problem or completing a routine check, but the command actually gives the attacker a way into the device. Between February and early May 2026, Microsoft Defender observed these attacker-supplied commands being run on more than 1.1 million unique devices. Instead of breaking through security directly, the attacker convinces the user to carry out a step that looks reasonable in the moment.

Phishing is adapting in much the same way. Microsoft found that adversary-in-the-middle phishing has become one of the dominant techniques it sees. In these attacks, someone may be sent through what looks like a normal sign-in process while the attacker quietly captures both the login information and the active sign-in session. That can sometimes let the attacker get around traditional multifactor authentication because they’re taking advantage of a session the user has already approved.

The delivery methods are changing too. Microsoft Defender for Office 365 detected more than 145 million QR-code phishing attacks during the reporting period. One example starts with a PDF on a work computer. The employee scans a QR code with a phone and lands on a fake sign-in page, moving the interaction onto another device and potentially outside some of the protections watching the company computer.

Other attacks may not look suspicious at all when they begin. Microsoft found that business-contact impersonation often starts with a simple message asking whether someone is available. The attacker begins a normal-looking conversation and waits until the person responds before introducing the fraudulent request. Microsoft also saw a sharp increase in voice phishing through Teams, showing how these attacks are moving into the same communication tools employees already use during the workday.

People aren’t the only way in. Internet-facing systems like firewalls and VPNs remain attractive targets, especially when a newly discovered security flaw isn’t fixed quickly. Microsoft tracked an Akira ransomware surge across more than 50 organizations, most of them small and midsize businesses, tied to exploitation of a SonicWall VPN vulnerability. The larger lesson is that knowing an update exists isn’t enough. Businesses also need to know which systems are affected and get those fixes applied before attackers can take advantage of the gap.

AI is accelerating many of these changes. It can help attackers research targets, create more convincing messages, find weaknesses, and automate parts of an attack. But Microsoft’s report doesn’t suggest that AI has replaced the person behind the attack. Instead, it’s making many existing techniques faster and easier to scale while putting more pressure on businesses to recognize and respond to them quickly.

Taken together, that leads to one of the report’s biggest business takeaways: resilience. Cybersecurity isn’t only about preventing an attacker from ever getting in. It’s also about whether the business can contain the damage, keep critical operations running, and recover when something goes wrong. Protecting accounts, keeping systems updated, helping employees recognize unusual requests, monitoring for suspicious activity, and having a recovery plan all work together because no single security tool can cover every path attackers are using. If you’re unsure how those risks apply to your own environment, reach out to Rocket IT using the link in this video’s description. And to stay up to date on trending technology news, hit that subscribe button and the bell to catch us on next week’s episode of Sync Up with Rocket IT.