Phishing evolves: QR codes, ConsentFix OAuth token theft, ClickFix variants and deepfake-enabled fraud defeat traditional red-flag training
ESET analysis describes how modern phishing and social engineering have shed the classic tells (poor grammar, suspicious URLs, crude login pages) and increasingly target live sessions and authentication tokens rather than passwords. Cybercrime-as-a-service phishing kits and AI tooling lower the cost of tailored, rapport-building lures. According to ESET telemetry, QR code phishing made up one in nine detected phishing emails in H1 2026, and Microsoft ranks QR codes as the fastest-growing email-based attack vector. The article argues that "human error" framing is insufficient and that defenders should rely on out-of-band verification, phishing-resistant authentication, session controls and detection/response capability (MDR).
Detalhes técnicos
- QR code phishing: the destination URL is hidden, and scanning occurs on mobile devices outside corporate laptop controls, which fragments visibility of the attack.
- ConsentFix: the victim lands on a compromised legitimate site showing a fake CAPTCHA-style prompt, goes through a real Microsoft sign-in flow, and is redirected to a URL containing an OAuth authorization code. The victim is told to paste that URL into the compromised page, letting the attacker exchange the code for access and refresh tokens. With an active Microsoft session, no password or MFA prompt is triggered.
- ClickFix detections continue to rise. The AI-fix variant places fake troubleshooting instructions on legitimate domains belonging to Anthropic, OpenAI and Microsoft. CrashFix, a fake ad blocker, points targets to the official Chrome Web Store and waits an hour after installation before showing its first bogus alert.
- Deepfakes: a finance employee joined a call with deepfake versions of senior colleagues and made wire transfers worth more than US$25 million.
- ESET MDR telemetry: almost 70% of incidents occur during business hours and 90% on workdays. The ESET SMB Cyber Readiness Index (4,400 decision-makers) shows 41% of investigations finish within two weeks and 34% take two to six weeks. Employees often delete phishing messages because no reporting channel exists.
Remediação
- Deploy phishing-resistant authentication and session controls.
- Require verification through a separate trusted channel, and a second approver, for payment requests and other high-stakes actions.
- Establish a clear channel for reporting suspected phishing.
- Correlate weak signals across accounts and devices, using automated analysis plus analyst review or MDR.
- Treat awareness training as one layer only; plan for attacks that employees do not spot.
Linha do tempo
-
Phishing evolves: QR codes, ConsentFix OAuth token theft, ClickFix variants and deepfake-enabled fraud defeat traditional red-flag training
ler a análise desta fonte ocultar
ESET analysis describes how modern phishing and social engineering have shed the classic tells (poor grammar, suspicious URLs, crude login pages) and increasingly target live sessions and authentication tokens rather than passwords. Cybercrime-as-a-service phishing kits and AI tooling lower the cost of tailored, rapport-building lures. According to ESET telemetry, QR code phishing made up one in nine detected phishing emails in H1 2026, and Microsoft ranks QR codes as the fastest-growing email-based attack vector. The article argues that "human error" framing is insufficient and that defenders should rely on out-of-band verification, phishing-resistant authentication, session controls and detection/response capability (MDR).
Technical Details
- QR code phishing: the destination URL is hidden, and scanning occurs on mobile devices outside corporate laptop controls, which fragments visibility of the attack.
- ConsentFix: the victim lands on a compromised legitimate site showing a fake CAPTCHA-style prompt, goes through a real Microsoft sign-in flow, and is redirected to a URL containing an OAuth authorization code. The victim is told to paste that URL into the compromised page, letting the attacker exchange the code for access and refresh tokens. With an active Microsoft session, no password or MFA prompt is triggered.
- ClickFix detections continue to rise. The AI-fix variant places fake troubleshooting instructions on legitimate domains belonging to Anthropic, OpenAI and Microsoft. CrashFix, a fake ad blocker, points targets to the official Chrome Web Store and waits an hour after installation before showing its first bogus alert.
- Deepfakes: a finance employee joined a call with deepfake versions of senior colleagues and made wire transfers worth more than US$25 million.
- ESET MDR telemetry: almost 70% of incidents occur during business hours and 90% on workdays. The ESET SMB Cyber Readiness Index (4,400 decision-makers) shows 41% of investigations finish within two weeks and 34% take two to six weeks. Employees often delete phishing messages because no reporting channel exists.
Remediation
- Deploy phishing-resistant authentication and session controls.
- Require verification through a separate trusted channel, and a second approver, for payment requests and other high-stakes actions.
- Establish a clear channel for reporting suspected phishing.
- Correlate weak signals across accounts and devices, using automated analysis plus analyst review or MDR.
- Treat awareness training as one layer only; plan for attacks that employees do not spot.