Drive-by compromise emerged as a prevalent initial access vector, with nearly 9.8 billion events blocked.