Cybersecurity Awareness Month 2026 – Don’t Make It Easy for Them
Awareness Month 2026 warns that AI phishing, QR codes, and ClickFix are driving everyday account attacks.
Cybersecurity Awareness Month 2026 pairs the UK National Crime Agency theme "Don't Make It Easy for Them" with CISA's "Securing the Next 250" and Canada's "Your best defence is you." Microsoft reported detecting about 8.3 billion email phishing threats in Q1 2026, with QR-code phishing its fastest-growing vector; Unit 42 said about 15% of roughly 75,000 QR-code pages seen daily led to malicious links. The article describes ClickFix fake-CAPTCHA prompts, Microsoft Teams IT impersonation, adversary-in-the-middle session theft, and OAuth device-code phishing against Microsoft 365, and recommends unique passwords, phishing-resistant MFA, patching, and tested backups.
- Microsoft saw about 8.3 billion email phishing threats in Q1 2026.
- QR-code phishing became the fastest-growing email attack vector.
- ClickFix lures users into running attacker-supplied system commands.
- AiTM and device-code phishing can hijack post-MFA sessions.
- UK, US, and Canadian agencies are running October campaigns.
Full article1,484 words · extracted from cybersecuritynews.com · click to collapse
Cybersecurity Awareness Month 2026 arrives as online attacks become easier to launch, harder to spot, and more focused on people. Observed every October, the campaign helps individuals and businesses build safer digital habits.
This year there are two themes. The NCA is running “Don’t Make It Easy for Them”, a push to make life harder for cybercriminals through small daily habits. CISA is running “Securing the Next 250”, tied to America’s 250th anniversary, with a strong focus on critical services like power and water.
The message is not limited to the U.S. Canada’s Get Cyber Safe program launched its own Cyber Month under the theme “Your best defence is you”, warning that AI is making scams look more real than ever.
After years of covering breaches, one pattern stands out to me: most incidents still start with a person being tricked, not a system being cracked. That is why this year’s focus on habits matters so much.
Phishing is no longer limited to badly written emails. Attackers now use fake CAPTCHA pages, QR codes, Teams chats, AI-written messages, OAuth flows, voice calls, and real-looking sign-in pages.
Microsoft said in its Q1 2026 email threat report that it detected about 8.3 billion email-based phishing threats during the first quarter of 2026. By the end of the quarter, QR-code phishing had become its fastest-growing attack vector.
Cybersecurity awareness is not a once-a-year training task. It is an everyday defense layer.
Why Cybersecurity Awareness Month Matters in 2026
Modern attacks often start with a normal action: opening an email, scanning a QR code, approving a sign-in, or following a “security verification” step. The goal is to make the request feel routine.
CyberSecurityNews has covered several clear examples. Recent ClickFix fake CAPTCHA attacks have convinced users to paste malicious commands into Windows Run. Other attackers have impersonated IT help-desk staff on Microsoft Teams and asked employees to install software or provide remote access. CyberSecurityNews has also reported on OAuth device-code phishing attacks targeting Microsoft 365 accounts.
These cases show why people still matter. Security tools stop many threats, but users must spot when a normal-looking action does not make sense.
10 Important Cybersecurity Habits to Stay Protected Every Day
1. Use a Unique Password for Every Account
Never reuse the same password across email, banking, social media, work accounts, and cloud services. If one site is breached, reused passwords can let attackers try the same login elsewhere.
2. Use a Password Manager
A trusted password manager can create and store long, random passwords. CISA includes password managers in its core online safety advice.
3. Turn on MFA Wherever Possible
Enable multi-factor authentication for email, cloud, banking, developer, and admin accounts. Prefer passkeys, hardware keys, or authenticator apps where supported. Never approve an MFA request you did not start.
MFA remains important, but users should also understand that modern phishing kits can steal authenticated sessions after MFA has been completed. CyberSecurityNews recently documented attacks where victims completed MFA but attackers captured the Microsoft 365 session.
4. Keep Devices and Apps Updated
Install security updates for Windows, macOS, Linux, Android, iOS, browsers, VPNs, routers, and business software. Attackers often scan for systems that have not received known security fixes.
5. Stop Before Clicking
Urgency is a common social engineering tool. Messages saying “act now,” “account locked,” “payment failed,” or “CEO needs this today” should make you slow down and verify the request through another channel.
6. Check the Real Destination
Before entering a password, inspect the site name. Attackers use look-alike domains, redirects, fake login pages, and trusted cloud services to hide the final destination.
Do not assume a page is safe simply because it contains Microsoft, Google, DocuSign, Cloudflare, or another known brand.
7. Treat QR Codes Like Links
Do not scan an unexpected QR code because it appears on a trusted-looking email, poster, invoice, or document.
Unit 42 researchers reported detecting about 75,000 QR codes each day, with around 15% of the pages containing QR codes leading to malicious links. CyberSecurityNews has also detailed how QR codes are being used for phishing and malicious mobile app delivery.
8. Never Run Commands From a Website
A web page should not normally tell you to press Win+R, open PowerShell, launch Terminal, or paste a command to “verify” yourself.
This is a key warning sign of ClickFix. Microsoft has documented ClickFix campaigns where fake CAPTCHA, download, and verification pages persuaded users to run attacker-provided commands.
9. Back Up Important Data
Keep important files backed up using a method that ransomware cannot easily change. For business systems, test recovery regularly. A backup matters only if it can be restored.
10. Report Suspicious Activity Quickly
Report phishing emails, unusual MFA prompts, fake IT messages, and unexpected login alerts. Fast reporting helps security teams block domains, revoke sessions, reset accounts, and protect other users.
1. AI-Written Phishing
Generative AI helps attackers create clean, personal phishing messages. Grammar mistakes are no longer a useful warning sign. Focus on the request, sender, link, and context.
CyberSecurityNews has detailed on how AI-generated phishing can steal authenticated browser sessions without traditional malware.
2. Adversary-in-the-Middle Phishing
Adversary-in-the-middle, or AiTM, phishing places attacker infrastructure between the victim and the real login service.
The victim may enter the correct password and MFA code, but the attacker captures the authenticated session and can use it to access the account.
3. OAuth Device-Code Phishing
This method sends victims to a real Microsoft sign-in page and asks them to enter an attacker-provided device code.
The website itself may be genuine, but approving the code can give the attacker access tokens. Proofpoint reported rapid growth in device-code phishing during 2026 as public tools and phishing services became easier to obtain.
4. ClickFix and Fake CAPTCHA Attacks
ClickFix pages tell users to run a command to complete a CAPTCHA, fix a browser issue, install an update, or open a file. In 2026, they targeted both Windows and macOS users.
The danger is that the victim performs the execution step for the attacker.
5. QR-Code Phishing
Also called quishing, these attacks place malicious links inside QR codes. The victim often moves from a protected desktop email environment to a mobile browser, where the final page may steal passwords, MFA codes, payment information, or other sensitive data.
6. Fake IT Help-Desk Messages
Attackers impersonate support staff through Teams, email, chat, or phone calls. They may ask the victim to open Quick Assist, install remote-control software, share a code, reset a password, or give them control of a computer.
7. Voice Phishing and AI Voice Cloning
A caller may pretend to be a manager, bank worker, supplier, or family member. AI voice tools can make the call more believable.
Verify sensitive requests through a known phone number or another trusted channel rather than trusting the incoming call.
8. Business Email Compromise
Business email compromise, or BEC, attackers impersonate executives, suppliers, finance teams, or customers to request payments, invoice changes, gift cards, or sensitive files.
A compromised real mailbox makes these messages especially convincing because the attacker may have access to previous email conversations.
9. Fake Job and Recruitment Attacks
Attackers use fake job offers, interview tasks, coding tests, and recruiter messages to steal login details, personal data, cryptocurrency, or developer credentials.
Some campaigns also deliver malware through project files or software packages.
10. Consent and App-Permission Scams
Instead of stealing a password, attackers may ask a user to approve a cloud app, OAuth connection, browser extension, or account permission.
One careless approval can provide long-term access to email, files, contacts, customer records, or other business data.
What Businesses Should Do During Cybersecurity Awareness Month
Organizations should use October to strengthen real habits, not just send yearly training slides. Run phishing drills, review MFA, remove unused accounts, test backups, patch exposed systems, and make reporting easy.
Security teams should also train staff on newer attack paths. Employees need to understand that a genuine Microsoft login page can still be part of phishing, a CAPTCHA can be malicious, and a Teams message from “IT Support” may actually come from an external attacker.
Good awareness programs avoid blame. People report mistakes faster when the process is simple, giving defenders time to reset passwords, revoke tokens, isolate devices, and stop a small event from becoming a larger breach.
Cybersecurity Awareness Month 2026 is a reminder that strong security is built from small actions repeated every day. The theme “Don’t Make It Easy for Them” fits the current threat landscape well.
Use unique passwords, enable MFA, update software, question unexpected requests, check links, avoid copied commands, and report suspicious activity early. Attackers will keep changing their tools, but these habits remove many easy paths they depend on.
Cybersecurity does not require every person to become a security expert. It requires people to recognize risky moments, slow down, verify unusual requests, and make the safer choice.