News Center
HP Shares Latest Threat Insights ReportHP Research: Who Has the Remote? Attackers Are Turning Legitimate Remote Access Tools Into BackdoorsHP threat researchers found attackers using tax year-end phishing lures, fake dating app downloads, bogus crypto wallet recovery tools and spoofed audio files to take over people’s PCs.HP announced its latest Threat Insights Report, which shows attackers using trusted software, disguised malware and increasingly believable lures to gain access to user devices. The research highlights a growing challenge for both users and defenders as malicious activity becomes harder to distinguish from legitimate behavior. The report provides an analysis of real-world cyberattacks, helping organizations keep up with the latest techniques cybercriminals are using to evade detection and breach PCs in the fast-changing cybercrime landscape. Based on the millions of endpoints running HP Wolf Security*, notable campaigns identified by HP Wolf Security threat researchers include:
Patrick Schläpfer, Principal Threat Researcher, HP Security Lab, comments: “What stands out in these campaigns is how easily legitimate remote access tools are being turned into entry points for attackers. By combining trusted software with carefully designed social engineering – tied to events like the end of the tax year – it’s getting even harder to distinguish what can and can’t be trusted.” By isolating threats that have evaded detection tools on PCs – but still allowing malware to detonate safely inside secure containers – HP Wolf Security has insight into the latest techniques used by cybercriminals. To date, HP Wolf Security customers have clicked on over 60 billion email attachments, web pages, and downloaded files with no reported breaches. The report, which examines data from January-March 2026, details how cybercriminals continue to diversify attack methods to bypass security tools revealing that:
Alex Holland, Principal Threat Researcher, HP Security Lab, comments: “These attacks don’t look like break-ins – they look like business as usual, blending in with normal IT activity and avoiding the warning signs associated with malware. To secure the future of work and reduce risk, organizations should restrict unnecessary privileges, control software installation, and isolate risky activity such as downloads and unknown links. Detection alone is not enough when legitimate tools are being turned into backdoors.” Source: HP media announcement | |
