Blackpoint 2026 report: ClickFix, SSL VPN logins and RMM tools drove most intrusions

Blackpoint Cyber's 2026 Annual Threat Report, drawn from thousands of incidents its SOC handled in 2025, finds that most intrusions didn't start with an exploit. They started with valid VPN logins, legitimate remote management tools and users pasting commands they were told to paste. For engineering teams that run their own infrastructure, this is the reality that patching alone does not fix.

What happened

Blackpoint, a managed detection and response provider, published the report on 7 April 2026. It covers calendar year 2025. The headline figures from the company's announcement:

• 57.5% of incidents involved fake CAPTCHA or "ClickFix" campaigns, where a web page tells the user to press Win+R and paste a command to "verify" themselves.
• 32.8% of identifiable activity involved SSL VPN compromise, often using credentials that were valid but stolen.
• 30.3% of incidents involved abuse of legitimate remote monitoring and management (RMM) tools.
• 56% of incidents were disrupted before a payload was deployed.
• Manufacturing and industrial organisations accounted for 11.5% of incidents.

The report's theme, in the words of Blackpoint's Chief Security and Trust Officer Wilfredo Santiago, is that "attackers today are not always breaking systems. They are exploiting trust."

Who is affected

• Organisations with internet-facing SSL VPNs that accept a password plus push or OTP MFA.
• IT teams and MSPs that use RMM tools (or whose users can install them freely), because attackers install the same tools to blend in.
• Any Windows user who can open the Run dialog, which is nearly everyone. ClickFix lures are generic and arrive from compromised legitimate websites as well as email.

Note that these figures describe Blackpoint's customer base, which leans towards small and mid-sized businesses served through MSPs. They are not a census of all intrusions.

What it means for developers and engineering teams

ClickFix works because copying a command from a web page into a shell is normal behaviour, and developers taught everyone that. The typical lure puts a PowerShell or mshta one-liner on the clipboard through JavaScript, then shows instructions to press Win+R, Ctrl+V and Enter. The command downloads and runs a loader, usually an infostealer or a remote access tool. No exploit or download prompt is involved, so browser and email defences rarely see anything.

VPN and RMM abuse share a pattern: the activity is technically legitimate. A VPN session from a valid account and a ScreenConnect or AnyDesk session look like normal work in logs. Detection has to come from context, such as a new device, an unusual time, an unusual geography or a tool that isn't on the approved list.

Lessons for teams building and running systems:

• Don't train users to paste commands. Prefer signed installers and package managers over curl ... | sh or "paste this into PowerShell" docs.
• Treat VPN credentials like production credentials, with phishing-resistant MFA and device checks. Better still, move internal apps behind an identity-aware proxy so the VPN isn't the only gate.
• Keep an allowlist of RMM tools. If you use one, an unknown second one is a strong signal.
• Watch what happens right after login. Blackpoint stopped 56% of incidents before a payload ran, which shows the gap between initial access and damage is often long enough to act in if someone is watching. New local admin accounts, security tools being disabled and RMM installs shortly after a VPN login are high-value alerts.

What to do now

1. Harden VPN access: require phishing-resistant MFA (FIDO2/certificates) or device posture checks, patch the appliance, and alert on logins from new countries, hosting providers or residential proxy ranges.
2. Restrict RMM tools. Use AppLocker or WDAC (or your EDR's app control) to block RMM binaries except the one you approve, and alert on any new RMM installation.
3. Blunt ClickFix. Alert when explorer.exe spawns powershell.exe, mshta.exe or cmd.exe with network-download arguments, which is what Run-dialog execution looks like. Consider the "Remove Run menu from Start Menu" Group Policy for staff who don't need it.
4. Brief staff with one rule: no legitimate website will ask you to press Win+R or open Terminal to prove you're human.
5. Review your own docs and onboarding scripts so they don't normalise piping remote scripts into a shell.

Related on TechLogHub

• Authentication: MFA and phishing resistance
• Authorization: least privilege for tools and users

Sources

• Blackpoint Cyber press release: Blackpoint Cyber releases 2026 Threat Report (7 April 2026)
• Blackpoint Cyber: Defending what attackers already trust
• Blackpoint Cyber: 2026 Annual Threat Report (PDF)