Attackers are Weaponizing Trust: What MSPs Must Do Next
For years, cybersecurity strategies were built around the assumption that attacks would look different from legitimate activity. Suspicious login locations, unusual software downloads, malware-laden attachments and repeated authentication failures served as reliable warning signs. Security teams could often identify malicious behavior because it stood out from normal operations.
That assumption is becoming increasingly dangerous.
Recent findings from Barracuda’s May 2026 SOC Threat Radar indicate a significant shift in attacker behavior. Barracuda researchers observed a roughly 25% increase in malicious Microsoft 365 logins from traditionally “low-risk” countries, including the United States and the United Kingdom, underscoring how threat actors increasingly use legitimate-looking infrastructure and trusted geographies to evade detection. At the same time, researchers documented attacks using fake AI software installers and fileless malware execution techniques designed to blend seamlessly into normal business activity.
The result is a new generation of threats that are harder to detect because they no longer appear inherently suspicious.
For managed service providers (MSPs), this evolution marks a critical turning point. Traditional detection models based on static indicators and known attack signatures are increasingly ineffective against adversaries who intentionally operate within the bounds of normal activity. To stay ahead, MSPs must shift their focus from identifying suspicious events to understanding suspicious behavior.
The rise of identity-driven attacks
One of the most notable findings from Barracuda’s Threat Radar research is the continued rise in attacks focused on identity compromise.
Attackers increasingly gain access to environments not by exploiting software vulnerabilities but by stealing, purchasing, or otherwise obtaining legitimate credentials. Once inside, they can move through systems while appearing to be authorized users.
The challenge for defenders is clear. A successful login with valid credentials often triggers few, if any, traditional security alerts. From the perspective of many security tools, the user has authenticated successfully and is behaving normally.
Compounding the problem is the growing number of successful Microsoft 365 logins from locations traditionally considered “low risk.” For years, organizations relied on geographic assumptions to identify suspicious activity. However, attackers have adapted by using proxy services, residential IP addresses and cloud infrastructure that blend seamlessly into legitimate traffic patterns.
The implication for MSPs is clear: Where a login originates is becoming less important than what happens after the login.
When legitimate tools become attack tools
The same principle applies beyond authentication.
Threat actors are increasingly using legitimate administrative tools and trusted applications to carry out attacks. Rather than introducing obviously malicious software into an environment, they use tools that administrators and employees already rely on every day.
This approach significantly reduces their visibility to conventional security controls.
Barracuda researchers also identified attacks in which malware was delivered and executed directly from a victim’s clipboard. These “paste-and-run” techniques allow adversaries to execute malicious code without using traditional files, significantly reducing opportunities for endpoint security tools to detect suspicious activity.
From an attacker’s perspective, this strategy offers a significant advantage. Security controls are often configured to trust approved applications and known workflows. By hiding within those trusted processes, adversaries can extend dwell time and increase the likelihood of achieving their objectives before detection.
For MSPs, this means monitoring tools alone are no longer sufficient. Providers must understand the context of user and system activity to determine whether seemingly legitimate actions indicate compromise.
AI lures are amplifying the problem
The rapid adoption of artificial intelligence has introduced another layer of complexity.
Threat actors are increasingly using AI-themed branding and messaging in phishing campaigns, capitalizing on widespread interest in emerging technologies. Employees eager to learn about new AI capabilities or experiment with productivity tools may be more likely to engage with convincing AI-related content.
One incident documented by Barracuda involved a fake Claude AI installer that redirected users to a convincing spoofed website. Instead of downloading legitimate software, victims triggered a multi-stage attack that executed PowerShell scripts, stole browser-stored credentials, communicated with attacker-controlled infrastructure and established persistence through malicious certificates. The attack was contained quickly, but not before post-exploitation activity had begun.
The effectiveness of these campaigns has less to do with technical sophistication and more to do with psychology. Attackers understand that trust and curiosity are often stronger motivators than fear.
This trend underscores a broader reality: Social engineering remains one of the most effective attack vectors. As technologies evolve, attackers continue to succeed by manipulating human behavior and exploiting organizational trust.
MSPs should view AI-themed phishing campaigns as another example of adversaries adapting their tactics to current business trends. The underlying objective remains unchanged: to gain access to identities, establish persistence and operate undetected.
Why traditional detection models are struggling
Many security operations centers (SOCs) still prioritize indicators such as failed logins, malware detections and known threat signatures. While these signals remain valuable, they capture only part of the threat landscape.
Modern attackers increasingly generate signals that appear legitimate.
- A successful login from a valid user account.
- A trusted application launching a system process.
- An employee accessing a familiar cloud platform.
- A user downloading a file from a well-known service.
Viewed individually, none of these activities necessarily warrants concern. The risk emerges when seemingly normal events are analyzed collectively and in context.
This is where traditional rule-based detection approaches often fall short. Static thresholds and predefined indicators may miss attacks designed to blend into expected behavior patterns.
To address this challenge, MSPs need detection strategies that emphasize behavioral analysis rather than isolated events.
The good news is that MSPs are uniquely positioned to help customers adapt to this new threat landscape. Success starts with shifting security conversations away from perimeter-focused thinking and toward identity-centric risk management.
Several priorities should take precedence.
- Strengthen identity protection. Identity has become the primary attack surface for many organizations. MSPs should help clients implement phishing-resistant authentication methods, enforce conditional access policies and continuously evaluate privileged accounts for signs of misuse.
- Prioritize behavioral visibility. Organizations need deeper insight into how users, devices and applications behave over time. Behavioral analytics can help identify subtle anomalies that may indicate compromised accounts or insider threats, even when traditional alerts are absent.
- Focus on rapid investigation and response. Because modern attacks often appear legitimate, detection alone is insufficient. MSPs should refine investigation workflows and incident response capabilities to reduce the time between initial compromise and containment.
- Validate trust continuously. Security programs should avoid assuming that previously trusted users, devices or applications remain trustworthy indefinitely. Continuous verification is increasingly essential in environments where attackers actively exploit established trust relationships.
- Educate users on emerging social engineering tactics. Security awareness training must evolve alongside attacker techniques. Employees should understand how AI-themed phishing campaigns and other trust-based attacks operate, enabling them to recognize suspicious activity before credentials are compromised.
Trust is the new attack surface
The findings from Barracuda’s latest Threat Radar highlight an important reality: Attackers are no longer relying primarily on technical exploits to gain an advantage. Instead, they’re exploiting the trust relationships organizations rely on every day: Valid credentials, trusted applications, familiar workflows and legitimate platforms.
These are no longer simply business enablers. They’re becoming attack vectors.
The data from Barracuda’s SOC Threat Radar points to a clear conclusion: Attackers are increasingly succeeding not because defenses are weak, but because they’re exploiting the very mechanisms organizations trust most. As identity abuse, trusted-tool exploitation and AI-themed social engineering continue to rise, MSPs that can correlate behavior, context and risk across the entire attack chain will be best positioned to protect customers from threats designed to remain invisible.
For MSPs, the path forward is clear. Security strategies built on static indicators and reactive defenses must evolve toward continuous behavioral monitoring, identity-centric protection and rapid response capabilities. As attackers grow more adept at hiding in plain sight, the providers that succeed will be those able to interpret risk where others see routine activity.
Merium Khalid
Merium Khalid is Director of AI & Automation, Office of the CTO, at Barracuda. She has extensive experience in analyzing data, identifying threats, conducting incident response, and research and development, among other areas. Merium received her bachelor’s degree in computer science from SUNY Old Westbury and has many years of experience leading and handling security operations.