Living off the land

Attackers ran ClickFix into 47% of the initial access Microsoft logged last year

Bitdefender puts 84% of its high-severity incidents on binaries that were already installed on the host. That figure and Microsoft's ClickFix number cover the two largest volume plays in the telemetry, and both sit outside what attachment scanning and patch cycles reach.