2026 Browser Attack Techniques

1 in 3 payloads intercepted by Push in 2025 were sent outside of email.

95% of in-browser attacks detected by Push used some form of bot protection service.

Of the last million logins Push saw, 1 in 4 were password logins, not SSO.

Of the last million logins Push saw, 2 in 5 were not protected by MFA.

Of the last million logins Push saw, 1 in 5 used a weak, breached, or reused password.

4 in 5 ClickFix payloads intercepted by Push were accessed via search engines as the result of malvertising or infected webpages.