Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Phishing emails can now look polished, fit a real business workflow and send people into legitimate sign-in pages. Spelling mistakes and suspicious-looking links are still clues, but their absence does not prove a message is safe. Treat urgent or consequential requests as something to verify independently, and make sure your organization can investigate and contain activity after a click.
Why phishing emails are harder to recognize
The purpose has not changed: get someone to disclose information, approve access, send money or run harmful instructions. What has changed is how closely a lure can resemble ordinary work. Attackers can use familiar context, polished language and legitimate-looking services, so a message may not fit the old picture of an obvious scam. ESET describes purpose-built AI tools as one way attackers can improve grammar and tailor lures, but polished writing alone does not establish that AI was used.
Urgency, unexpected credential requests and changes to payment instructions remain reasons to pause. They are not a complete checklist: a message can be dangerous without obvious errors, and a legitimate request can be urgent. Verify the action being requested rather than relying only on how the message looks.
What newer phishing techniques change
QR codes move the link to another device
In QR-code phishing, or quishing, the URL is embedded in an image. A recipient cannot hover over it in the email, and scanning may move the interaction from a managed computer to a personal phone with different security controls. ESET reported that QR-code phishing accounted for one in nine detected phishing emails in its own telemetry in H1 2026; that figure describes ESET’s detected sample, not all email traffic.
ConsentFix can target an authenticated session
ESET describes a ConsentFix scenario that begins on a compromised legitimate website. The victim is directed through a real Microsoft sign-in and authorization flow, then prompted to paste a resulting URL back into the site. In the described technique, an attacker can extract an authorization code and exchange it for access and refresh tokens. If the victim already has an authenticated Microsoft session, the flow may not require a fresh password or multifactor-authentication prompt. This is a specific abuse of an authorization workflow; it does not mean OAuth is generally unsafe or that MFA as a whole has been defeated.
ClickFix turns a prompt into a command
ClickFix attacks use fake errors, CAPTCHA pages, help screens or troubleshooting prompts to persuade a person to run or paste a command. ESET reported a 108% increase in detections classified under HTML/FakeCaptcha from H2 2025 to H1 2026, while saying those levels remained below the initial ClickFix boom it reported in H1 2025. The key warning is practical: a page that asks you to execute a command to fix a browser or account problem is not a normal verification step.
Other lures exploit familiar software and human context
ESET also describes CrashFix, in which a fake ad-blocker browser extension listed in the official Chrome Web Store delays a bogus alert. That example is not evidence that every store-listed extension is malicious; it is a reminder to scrutinize what an extension asks you to install or do. Attackers may also use synthetic voice or video to reinforce a plausible request. ESET cites a reported case in which a deepfake call preceded wire transfers exceeding US$25 million. That is an illustrative incident, not a typical or expected loss.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to check a suspicious work email
- Pause at consequential requests. Treat payment changes, credential requests, unexpected QR codes and pressure to act immediately as reasons to stop and verify. Do not use the absence of typos, an unfamiliar-looking URL or a crude login page as your only test.
- Verify through a separate, trusted channel. For a payment, sensitive data request or access approval, contact the requester using a number or directory entry you already trust, or follow your established approval workflow. Do not rely on contact details supplied only in the questionable message. A second approver can add protection for high-value actions.
- Do not follow unexpected instructions to run commands. If a page, email or support prompt asks you to paste code into a system tool, stop and contact your IT team through its known support route.
- Report the message using your organization’s designated route. Reporting lets security staff look for related messages and activity; silently deleting a suspicious email can leave those signals undiscovered.
What organizations should put in place
Make reporting and verification routine
Give staff a clear, low-friction way to report suspicious messages and teach them how to independently verify sensitive requests. Training helps, but cannot carry the defense by itself: a well-contextualized lure may fool an attentive employee, so the organization also needs controls that limit what a successful click can do.
Use phishing-resistant authentication where services support it
FIDO2 combines WebAuthn and CTAP, and compatible implementations can use external security keys over USB, NFC or Bluetooth Low Energy (BLE). It is a category of authentication methods, not a guarantee that every application or login is covered. Before deployment, check support in the identity provider and critical applications, device compatibility, enrollment, recovery and backup procedures, including needs such as shared devices.
A synced passkey on a platform or device and a device-bound credential on a hardware key involve different operational trade-offs. Hardware keys need a compatible connection and a plan for backup credentials; whichever method is chosen, recovery must not become an easier phishing route. A FIDO2 USB/NFC security key is one possible control, not a universal purchase recommendation: confirm account support, form factor, enrollment and recovery requirements before selecting one.
Control sessions as well as passwords
Authentication is only one part of account security. Because some attacks seek tokens or exploit an already authenticated session, organizations should have procedures to investigate suspicious authorization activity and revoke or contain compromised sessions. A security key can strengthen sign-in, but it cannot by itself prevent every attack that occurs after authentication.
Prepare for the activity after a click
A click is an opening, not a verdict on the incident. The important question is what happened next: whether credentials or tokens were exposed, a command was run, files were accessed, or activity spread to another account or device. ESET recommends correlating weak signals across accounts and devices and pairing automated analysis with analyst investigation. Organizations need a route to contain affected sessions and devices quickly, whether monitoring is handled in-house or through a managed detection and response service.
ESET’s 2026 article says almost 70% of security incidents in its MDR telemetry occurred during typical business hours and 90% on workdays. Those are ESET telemetry figures, not universal incident rates. They nevertheless underline the operational need to know who will investigate reports and alerts during the hours an organization actually works.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why response readiness matters
Organizations that take longer to investigate may leave suspicious access active for longer. In ESET’s 2026 SMB Cyber Readiness Index, a survey of 4,400 decision-makers, 41% said investigations were completed within a fortnight and another 34% said they took two to six weeks. These are survey findings, not a universal benchmark for incident response.
Tomáš Foltýn, author of ESET’s article, puts the distinction plainly: “The employee’s click gives the attacker an opening, but the eventual damage, or lack thereof, depends on the preventive controls still standing and on how quickly the company detects and contains what follows.” For an employee, that means reporting promptly rather than assuming the mistake is harmless. For an organization, it means making the next steps clear: preserve the report, assess identity and device activity, and contain affected access when warranted.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
