The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard.
Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones
Summary + source link. No paywalls, no tracking.