The devil is still in the email – but wearing a new mask

Business Security

When phishing can increasingly pass familiar checks, avoiding or limiting the damage depends on how quickly your company can detect and contain the attack

28 Sep 2026  •  , 6 min. read

Many of today’s phishing attempts are no longer betrayed by poor grammar, a sketchy URL or a crude login page. To be sure, it does still pay to look out for these red flags, but their absence doesn’t make a message legitimate. Modern social engineering schemes are increasingly designed to withstand scrutiny and to provide reassurance where an attack might once have left some giveaways.

By extension, email-borne threats in particular are now built to meet as little resistance as possible. They subvert legitimate workflows and reach employees mid-task, when their accounts are authenticated and any incoming requests for action feel like part of an ordinary working day. Some techniques go after live sessions themselves, with attackers shifting their focus from stealing passwords to stealing authentication tokens.

With the cybercrime-as-a-service economy thriving, anyone with ill intent can buy a ready-made phishing kit that arrives complete with the machinery for capturing logins. Meanwhile, AI has slashed the amount of time and effort needed to research a large number of targets and strike the right tone for each of them. Much of this developing faster than many companies can come to grips with the shifts.

What the training taught

Bad grammar was the first tell to go. Purpose-built AI tools now make it trivial to clean up the language and even tailor the lure for each recipient. Instead of one-and-done attempts, some bad actors are also using AI to build rapport with their marks before eventually ‘going in for the kill.’ These days, polished or culturally nuanced writing says nothing about whether a message is genuine.

The URL link has also become an ‘unknown quantity.’ When the destination URL is hidden inside a QR code, there’s nothing to hover over. What’s more, the code is scanned on a phone, so the usual controls that protect company-issued laptops don’t apply. The ‘device hop’ also means that the company may have a hard time developing a full picture of the attack. To put things into perspective – QR code phishing accounted for one in nine detected phishing emails in ESET’s telemetry in the first half of 2026 while Microsoft ranks QR codes as the fastest-growing email-based attack vector.

How about the fake login page – the one that awareness training materials conveniently highlight in a red rectangle? ConsentFix, for one, dispenses with it entirely. The victim lands on a compromised but legitimate website, where a fake CAPTCHA-style prompt sends them through a real Microsoft sign-in flow before redirecting them to a URL containing an OAuth authorization code. They’re then instructed to paste that URL back into the compromised page, allowing the attacker to extract the code and exchange it for access and refresh tokens. Importantly, once the victim already has an active Microsoft session, no password or multi-factor authentication (MFA) prompt is triggered to foil the attack. 

On a related note, detections of ClickFix – a social engineering trick that dupes the victim into pasting a command into their own terminal – continue to soar. Its variant known as AI-fix has been spotted placing fake troubleshooting instructions on legitimate domains that belong to Anthropic, OpenAI and Microsoft. Meanwhile, a fake ad blocker known as CrashFix, points targets to the official Chrome Web Store, and even waits an hour after installation before displaying its first bogus alert, likely to sever the mental link between cause and effect. 

As neither seeing nor hearing is believing these days, a recognizable face or voice doesn’t always provide conclusive evidence of who’s behind the request. Employees who encounter lifelike but fake audio and video in the middle of work often lack the opportunity to examine every frame or to listen or watch for possible synthetic tells revealed by older deepfake creations. Indeed, even an imperfect imitation could be convincing when the context feels plausible – such as when a finance employee joined a call populated by deepfake versions of senior colleagues and still ended up making wire transfers worth more than US$25 million.

Don’t stop at human error 

Blaming an incident simply on “human error” identifies just one link in the chain without explaining why a momentary lapse in judgment ultimately triggered a full-blown crisis. Security awareness training can instill good habits and sharpen the eye for fraudulent messages, but it can’t insert an obvious red flag into a message without one, particularly now that many attacks anticipate the checks that employees have learned to make. The employee’s click gives the attacker an opening, but the eventual damage, or lack thereof, depends on the preventive controls still standing and on how quickly the company detects and contains what follows.

ESET’s Q1 2026 MDR report also found that employees often recognize phishing and spam messages for what they are, yet go on to simply delete them, because nobody has established where such messages should be reported. The company loses the chance both to teach other employees about new ‘tricks of the phishing trade’ and to glean some wider lessons from the attack. It may miss an early opportunity to investigate whether the message is part of a large-scale campaign.

On this note, ESET's SMB Cyber Readiness Index found that the adoption of awareness training is highest among businesses that have already suffered multiple incidents. The same survey found businesses worrying most about AI-powered malware, even though actual incidents still begin with phishing, unpatched software, gaps in monitoring and weak passwords. AI’s role is in making well-established methods faster and more scalable.

Don’t trust – verify instead

Bad actors now reproduce many of the signs of legitimacy that most people have learned to seek, so controls need to rely on verification against something that the message did not provide. Payment requests and other high-stakes actions increasingly require additional checks, including confirmation through a verified channel and possibly involving a second approver. 

When anything convincing can be fabricated with ease, context also matters more than ever. This requires picking up the various ‘breadcrumbs’, such as network connections and file modifications, that are left as an attack passes through the company’s environment. Each of them may look unremarkable on its own, but multiple seemingly disparate artifacts could point to an ongoing attack. Automated analysis can group related signals across accounts and devices while analysts establish whether the pattern amounts to an active compromise and how to respond. State-of-the-art managed detection and response (MDR) adds investigative prowess and capacity, turning weak signals into a coherent story and giving a small team access to capabilities that it couldn’t staff and operate alone.

ESET MDR telemetry shows that almost 70% of security incidents occur during typical business hours, with 90% falling on workdays. Meanwhile, the ESET SMB Cyber Readiness Index – which is based on a survey among 4,400 decision-makers – points to how long investigations typically run: 41% are completed within a fortnight; another 34% take two to six weeks. The latter in particular is a timeframe that a company can hardly absorb without severe operational disruption.

For SMBs in particular, the resources needed to watch over the expanding attack surface don’t move in lockstep with the increasing scale and sophistication of adversarial methods. A hundred-person company may depend on the same types of cloud, identity, payment and collaboration systems as a much larger one, but it has far fewer people available to keep tabs on them. For a lean IT team, investigation competes with other duties involved in keeping systems running, and sprawling toolsets risk forcing understaffed teams to manage inefficient "swivel-chair environments.” 

Multi-layered preventive foundations, including phishing-resistant authentication and session controls, go a long way toward defeating credential-stealing attempts. Social engineering increasingly tests more than the recipient’s eye for detail, and the outcome also hinges on what happens in the minutes and hours following the click. Any workable security plan must account for attacks that employees don’t spot. AI helps deal with the volume and speed involved, whereas experienced analysts can assess the evidence and direct the response.