Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Turning on multifactor authentication (MFA) does not make a company email account immune to phishing. An attacker can relay a sign-in through a proxy and steal the session token, or persuade a user to authorize the attacker’s session through a device-code flow. Microsoft’s 2026 Digital Defense Report treats these attacks as an identity and trusted-access problem: phishing-resistant authentication, disciplined access controls, email protections, and joined-up security monitoring all matter.
What Microsoft’s figures say—and what they do not
Microsoft’s 2026 Digital Defense Report describes activity detected in Microsoft’s own telemetry. Its numbers show the scale and variety of threats Microsoft observed; they are not independently measured rates for every organization or email provider.
- Microsoft reports more than 46 million business email and contact impersonation attacks detected over the preceding 12 months.
- Microsoft says 89–95% of email phishing attachments in its observations led to a credential-theft effort.
- Microsoft Defender for Office 365 detected more than 145 million QR-code phishing attacks between July 2025 and June 2026.
- Microsoft reports that 52.2% of valid-account intrusions involved follow-on credential theft.
These figures point to an important distinction: an email threat may begin with impersonation or a malicious attachment, but its consequences can extend into account access, credential theft, and further abuse of trusted mailboxes. They should not be read as a forecast of any one company’s risk or as a comparison across security vendors. Microsoft Digital Defense Report 2026
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How phishing can get past conventional MFA
Adversary-in-the-middle token theft
In an adversary-in-the-middle (AiTM) attack, a proxy sits between the user and the legitimate sign-in service. The user may complete a familiar sign-in and MFA challenge, but the proxy relays the exchange and captures the resulting authentication token. An attacker can then use that token to access the account without simply replaying the password.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft’s April 2026 campaign analysis describes attackers proxying authentication sessions and capturing tokens, allowing account access despite non-phishing-resistant MFA. In that observed campaign, Microsoft said more than 35,000 users across over 13,000 organizations in 26 countries were targeted; 92% of targets were in the United States. Those figures describe that campaign only, not phishing overall. Microsoft’s April 2026 campaign analysis
Device-code phishing
Device-code phishing exploits a legitimate sign-in flow rather than stealing a password through a fake login page. An attacker initiates a device-code authorization, then persuades a user to enter the code—often through a convincing lure. If the user approves it, the attacker’s session may be authorized. Microsoft recommends blocking device-code flow where it is not needed and tightly scoping exceptions for business cases that require it, such as certain Teams devices. Microsoft’s EvilTokens analysis
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why a stolen session matters to company email
Once an attacker has mailbox access, the risk is not limited to reading messages. Microsoft’s EvilTokens analysis describes email exfiltration, malicious inbox rules that hide activity, possible addition of devices, and use of mailbox content to write more convincing follow-on phishing. A compromised mailbox can therefore become a platform for persistence and internal impersonation.
Free tools Windows power users keep installed
One-click scans. No signup required.
What “phishing-resistant MFA” changes
Conventional MFA methods can add a meaningful barrier to password theft, but a user-entered code or approval may still be relayed or manipulated. Phishing-resistant authentication is designed to bind authentication to the legitimate service or context, rather than relying on a code that can be entered into an attacker-controlled flow. Microsoft Learn calls it the new baseline: “Traditional MFA is no longer enough—phishing-resistant MFA is the new baseline.” Microsoft Entra authentication strengths
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft’s guidance names FIDO2 security keys and passkeys, and recommends enforcing phishing-resistant methods with Conditional Access. A security key is a physical-product option, but compatibility depends on the organization’s identity provider, supported devices, and policies; confirm those details before choosing a model. Microsoft Entra authentication strengths
When comparing authentication options, assess whether the method is resistant to phishing, whether it binds sign-in to the legitimate service and device context, which identity providers and endpoints it supports, how enrollment and recovery work, and whether policy can enforce it consistently. A strong method that is not deployed to the right users or cannot be recovered safely may leave gaps in practice.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What company email and identity teams should do
1. Prioritize phishing-resistant sign-in
Plan migration for users with access to company email and other high-value services, then use Conditional Access to require the intended authentication strength where supported. Pay particular attention to privileged accounts and users who can approve access or change security settings. Confirm enrollment, recovery, and device compatibility before tightening policy so a rollout does not create avoidable lockouts.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →2. Reduce standing privilege and persistence
Microsoft’s report recommends identity hygiene, tiered administration, limiting standing or privileged access, and strong controls for privileged accounts. Give people only the access they need, for only as long as they need it, and review which accounts, devices, and sessions can persist after a user is compromised.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
3. Restrict risky authentication flows
Review whether device-code flow is required in the organization. Block it where possible; where a legitimate scenario depends on it, scope exceptions narrowly to the relevant resource accounts and policy conditions rather than leaving a broad allowance in place. Microsoft’s EvilTokens analysis also recommends reviewing protections against spoofing and risky mail flows.
4. Keep email defenses in place
Phishing-resistant sign-in does not replace email security. Microsoft recommends anti-phishing protections and correct email-security configuration, and its campaign analysis also points to SmartScreen-capable browsers. Mail-flow controls and spoof protections can reduce opportunities for impersonation, while URL and attachment protections help address lures that reach inboxes. Evaluate email-security services by their spoof and impersonation controls, URL and attachment handling, investigation visibility, integration with identity and endpoint signals, and operational fit; Microsoft’s cited material does not provide a controlled product comparison.
5. Correlate email, identity, and endpoint signals
Microsoft’s report argues that signals across endpoint, identity, cloud, applications, email, and networks can reveal patterns that are hard to see when each source is reviewed alone. For an email-related incident, connect suspicious message activity with sign-in and token events, endpoint alerts, mailbox-rule changes, device additions, and unusual outbound mail. Microsoft summarizes its report’s conclusion as: “Identity is the primary control plane for defense.”
How to interpret the campaign reports
The scale of Microsoft’s reported observations is useful context, but the scope matters. The April 2026 AiTM analysis describes one campaign’s targets. Microsoft’s September 2026 EvilTokens analysis attributes to that platform campaigns that compromised more than 12,000 inboxes across over 10,000 organizations worldwide. Neither figure establishes how common these attacks are across all organizations, nor does either prove that every MFA-bypassing attack uses AiTM. Microsoft’s EvilTokens analysis
The practical takeaway is to treat MFA as one layer in an identity-centered defense. Resistance to phishing, limited privilege, controlled authentication flows, robust email protections, and connected monitoring address different parts of the attack path; no single setting makes company email immune to compromise.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
