Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Protecting an organization from AI-powered phishing requires a layered identity and email program, not a single filter or an MFA checkbox. Set phishing-resistant authentication as the target state, enforce it with context-aware access policies, remove unnecessary account and administrator exposure, inspect email and browser activity, and prepare to revoke tokens and mailbox persistence when an account is suspected. AI can make lures more convincing and campaigns more adaptive, but it does not make every phishing message AI-generated or make any one control sufficient.
What AI-powered phishing changes—and what it does not
Generative systems and automation can help an attacker tailor a message to a person’s role, imitate a familiar workflow, generate many variations, and react to a victim’s action. The defensive implication is that old rules such as “look for spelling mistakes” are weak signals. A message can be grammatically polished, relevant to the recipient’s job, and still be an attempt to obtain credentials, an access token, or an approval.
As an Amazon Associate I earn from qualifying purchases.
AI is an amplifier rather than a separate category of compromise. The same defensive objectives still apply: prevent unauthorized authentication, limit what a compromised identity can reach, detect unusual activity, and contain it quickly.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Documented campaign: In an April 2026 investigation, Microsoft described a device-code phishing campaign in which automation and generative AI produced lures aligned to a target’s role. After the user interacted with the lure, the campaign dynamically generated a device code. The user could then be tricked into authorizing an attacker’s session on another device.
- Why the password may not be the end of the incident: Microsoft reported that obtained tokens were used for email access, reconnaissance, malicious inbox rules, and possible lateral movement. A password reset alone can therefore leave an active session or persistence mechanism behind.
- Scale signals, not universal prevalence: Microsoft Defender for Office 365 reported detecting more than 145 million QR-code phishing attacks between July 2025 and June 2026. The same 2026 reporting said 89–95% of email phishing attachments led to a credential-theft effort. These are Microsoft product observations for the stated period, not totals for the entire internet.
Use those observations to design controls, not to assume that every message was AI-generated. Your own telemetry, identity architecture, and email platform determine which safeguards are available and how they should be tuned.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How a device-code phish can turn a click into account access
Device-code authentication has legitimate accessibility and device-connection uses. The risk appears when a person is persuaded to enter a code supplied by an attacker or to approve a sign-in they did not initiate. The attacker’s device receives the resulting token, while the victim may believe they are completing a normal sign-in.
- Lure creation: The attacker sends a role-specific message, QR code, or collaboration request that directs the recipient to an authentication step.
- Code generation: The attacker starts a device-code flow and presents the resulting code through the lure. In the documented campaign, the code was generated dynamically after the target engaged.
- User authorization: The recipient enters the code or approves a prompt without independently verifying the initiating device, application, and request.
- Token acquisition: The attacker’s device receives an authenticated token. No password needs to be collected in the classic “fake login page” sense.
- Persistence and discovery: The attacker accesses email, searches for organizational information, creates or changes inbox rules, and may use the identity to explore additional resources.
Train users to stop when a prompt, code, or QR destination is not clearly tied to an action they started. More importantly, use policy to restrict risky authentication paths and require phishing-resistant methods for the users and applications that support them.
Can AI phishing bypass MFA?
It can defeat the protection that an organization thinks MFA provides, but the mechanism matters. A stolen password may be blocked by a second factor; a user who approves an attacker’s transaction, enters a device code, or authenticates to a look-alike site can instead hand over a session or token. MFA is still valuable, but its strength depends on the method, the policy that enforces it, and the surrounding session controls.
Microsoft’s 2025 Digital Defense Report said its analysis found that 85% of usernames targeted in password-spray attacks appeared in known credential leaks. In the same report, Microsoft said MFA blocked access in over 99% of cases in which attackers had valid usernames and passwords. Those figures describe Microsoft’s telemetry and scope; they are not a guarantee for every MFA method, tenant, or organization. They do show why broad MFA coverage and resistance to phishing should be measured separately.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft Learn states: “Traditional MFA is no longer enough—phishing-resistant MFA is the new baseline.” The practical distinction is whether the authenticator is cryptographically bound to the legitimate relying party, rather than merely asking the user to type or approve a transferable code.
Make phishing-resistant authentication the target state
Passkeys, platform authenticators, security keys, and SMS codes
| Method | Phishing resistance | Operational strengths | Trade-offs to plan for |
|---|---|---|---|
| Passkey or platform authenticator | Designed to bind authentication to the legitimate site or relying party; generally phishing-resistant when supported and correctly enforced. | Uses a device users already carry; can provide a low-friction sign-in experience. | Support differs by identity provider, application, operating system, browser, and shared-device scenario. Recovery and device replacement must be designed before rollout. |
| FIDO2 security key | Phishing-resistant when the identity provider and application support the protocol. | A separate physical credential can work where platform passkeys are unavailable or where administrators require a dedicated key. | Keys must be distributed, registered, replaced when lost, and securely deactivated. Test compatibility before buying at scale; no particular model is universally suitable. |
| Push approval or one-time code | Stronger than a password alone, but susceptible to social engineering, prompt fatigue, proxy attacks, or device-code abuse if the user is tricked. | Usually familiar and widely supported. | Do not treat availability as proof of phishing resistance. Require transaction context, number matching, risk checks, or a stronger method where the platform supports them. |
| SMS code | Not phishing-resistant; a code can be relayed or captured after a user is sent to a fraudulent site. | Works on many phones and can be useful as a tightly controlled fallback. | Use only where stronger options are not yet possible, and protect enrollment, recovery, and fallback paths from becoming the easiest route around policy. |
Roll out the stronger method without creating a recovery gap
- Inventory the estate: List identity providers, privileged and ordinary user groups, managed and unmanaged devices, critical applications, external users, service accounts, and every sign-in or recovery path. Mark where FIDO2 or passkeys are supported and where they are not.
- Pilot high-risk users first: Start with administrators, finance and executive accounts, help-desk staff, and users with access to sensitive data. Test sign-in from normal and unusual devices, travel scenarios, shared workstations, and offline or replacement-device cases.
- Secure enrollment: Verify the person and the device through an existing trusted process. Where the platform provides temporary, time-limited onboarding or recovery credentials, restrict them to that purpose and record who issued them.
- Enforce, do not merely offer: Use conditional-access or equivalent policies to require the phishing-resistant method for privileged accounts first, then expand by application and user group. An authenticator that is available but optional will not protect a sign-in path an attacker can choose instead.
- Build lifecycle controls: When a person joins, changes role, loses a device, or leaves, register, replace, suspend, and remove authenticators as part of the identity workflow. Require more than an email request to recover a high-value account.
- Measure effective coverage: Track enrollment, the percentage of sign-ins actually requiring the strong method, fallback usage, recovery events, failed registrations, and help-desk resolution time. Investigate groups that remain on weaker methods.
Microsoft’s guidance highlights hardware distribution, platform differences, user training, provisioning complexity, and implementation effort. Include those costs in the rollout plan instead of treating the purchase of a key or enabling of a passkey as the complete project.
Reduce the value of a stolen account
Authentication prevents many compromises, but an account that is compromised should still have limited reach. Apply the following controls as an identity hygiene program:
Recommended Free Tools
- Use context-aware access: Evaluate device state, location, network, application, risk signals, and session behavior. Require stronger authentication or block access when the context is inconsistent with the user’s normal activity.
- Remove stale accounts: Disable accounts for departed staff, contractors, and unused test identities. Review dormant guest access and memberships in privileged groups.
- Reduce standing privilege: Separate everyday work from administrative accounts, grant only the permissions required for the job, and review standing administrator access on a defined schedule.
- Inventory non-human identities: Document service accounts, workload identities, application registrations, delegated permissions, owners, secrets, and expiration dates. Remove unused credentials and permissions.
- Prevent password reuse: Where passwords remain, require unique credentials and protect them with an approved password-management process. A password exposed at one service must not unlock another.
- Control legacy and fallback paths: Identify older protocols and recovery methods that do not support the organization’s stronger policies. Retire them where possible or place them behind compensating controls and close monitoring.
Microsoft’s 2025 reporting recommends conditional access, stale-account cleanup, monitoring, and reducing password reuse. Treat those measures as mutually reinforcing: MFA cannot compensate for an account that has excessive permissions, and least privilege cannot compensate for an authentication method that is easy to phish.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Protect email, browsers, and the click
Email controls
- Scan inbound messages, attachments, QR codes, and URLs using the capabilities of your mail platform.
- Use time-of-click link checks so a URL that becomes malicious after delivery is evaluated when the user opens it.
- Enable post-delivery purge or equivalent removal so newly classified malicious messages can be deleted from mailboxes after delivery.
- Quarantine suspicious messages and make release decisions traceable. Treat messages that imitate internal requests, password resets, invoices, or shared documents as high-risk even when the sender display name looks familiar.
Browser, endpoint, and network controls
Use browser reputation, endpoint protection, and network protections to block known malicious sites, downloads, and command channels. Microsoft’s June 2026 guidance recommends email protections together with browser and network controls; map those recommendations to the tools your organization actually operates rather than assuming a Microsoft-specific feature exists in another platform.
Make verification a separate action
Teach staff to verify unusual payment requests, password-reset requests, device-code prompts, and requests for confidential files through a known channel: a saved phone number, an existing ticket, or a separately initiated conversation. Training should explain what to do, not just show examples of bad grammar. It is a supporting control, never the only line of defense.
Monitor identity activity as a detection source
Centralize sign-in, audit, email, endpoint, and identity-provider logs where possible. Assign an owner and an escalation path for each alert so suspicious activity is investigated rather than accumulated in a dashboard.
| Signal | Why it matters | Useful first action |
|---|---|---|
| Sign-in from an unusual location, IP address, device, or application | May indicate stolen credentials, a stolen token, or an attacker using infrastructure the user has never used. | Review the session, device, authentication method, and adjacent activity; apply a step-up challenge or revoke access according to risk. |
| Repeated failures followed by a successful sign-in | Consistent with password spraying, credential stuffing, or an attacker learning which account is valid. | Correlate source addresses and targeted accounts, check exposure of the account, and confirm that stronger authentication was required. |
| Unexpected MFA registration, reset, or recovery event | An attacker may be trying to establish a new factor or weaken the recovery path. | Verify the event with the user through a known channel, suspend the change if unauthorized, and inspect administrator actions. |
| New inbox rule, forwarding destination, delegate, or application permission | These changes can provide quiet persistence or exfiltration after the initial sign-in. | Preserve the rule and audit record, remove unauthorized changes, and investigate messages and data accessed while it existed. |
| Unusual device-code, OAuth, or cloud-data activity | May show token acquisition or use of an application consent path rather than a password attack. | Identify the requesting application and token or session, revoke it where supported, and review the account’s recent access. |
Alert thresholds must reflect your users’ travel, remote-work patterns, service accounts, and normal application behavior. A useful alert has a named investigator, an expected response time, and enough context to decide whether to contain the session.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do if an employee enters credentials or approves a suspicious prompt
Assume the account may have been compromised even if the employee reports only a password entry. If a device code, OAuth consent, or MFA approval was involved, treat the session or token as potentially active.
- Record the facts immediately: Capture the message, URL or QR destination, time, device, user, prompt text, code flow, and what the employee entered or approved. Do not delete evidence before it is preserved.
- Contain the identity: Disable or restrict the account according to your incident playbook, block the malicious session, and stop risky access while preserving the ability to investigate. If the platform supports it, revoke active sessions, refresh tokens, device-code tokens, and application grants associated with the incident.
- Re-establish trusted authentication: Reset the password if one was exposed, remove unauthorized authenticators, verify recovery details, and enroll a trusted phishing-resistant method. A password change without session and token revocation is incomplete.
- Inspect mailbox persistence: Review inbox rules, forwarding, delegates, shared-mailbox access, transport changes, and newly authorized applications. Remove unauthorized changes and determine when they were created.
- Scope data access: Check email searches, downloads, cloud-file activity, address-book reconnaissance, and access to sensitive applications. Identify messages or records that may have been read, altered, or exfiltrated.
- Search for spread: Look for similar messages sent from the account, new privileged-group membership, additional compromised users, suspicious sign-ins, and use of the account against other services.
- Preserve and escalate: Retain relevant logs, headers, rules, tokens, application identifiers, and timeline details. Escalate to the organization’s incident-response process, legal counsel, privacy team, insurers, regulators, or law enforcement when required by your policies and jurisdiction.
- Communicate safely: Tell the affected user what happened and how to report follow-up prompts. Notify recipients of malicious messages through a trusted channel, not by replying to the compromised thread.
The April 2026 Microsoft campaign demonstrates why this sequence includes tokens and mailbox rules. Attackers can retain access or exfiltrate mail even after a user changes a password.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to stop stolen credentials from being reused
Credential theft is often a reuse problem: a password captured from one site, a leaked username, or an old account can be tested against many services. Build controls that make reuse unprofitable.
- Require a unique password wherever a password is still necessary, and block known compromised passwords when your identity platform supports that check.
- Use phishing-resistant authentication for privileged users and then expand it to ordinary users and critical applications. Do not leave an unprotected fallback as the default path.
- Apply conditional access to evaluate sign-in context and deny or challenge high-risk attempts.
- Remove unused accounts, old application credentials, stale guest memberships, and unnecessary delegated permissions.
- Monitor for password-spray patterns: many accounts targeted from one source, low-volume failures spread across users, or a successful sign-in after repeated failures.
- Review password-reset, MFA-enrollment, and account-recovery events with the same seriousness as a successful login.
Microsoft’s 2025 report said that, in its May 2025 comparison with Have I Been Pwned, 85% of usernames targeted in password-spray attacks appeared in known credential leaks. It also stated: “On average, each compromised username appeared in three separate logs, highlighting the magnitude of the global credential leak problem.” These are Microsoft’s analysis and report context, not a universal measure of every organization’s exposure.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
A practical implementation sequence
Phase 1: Establish an accurate baseline
- List identity providers, email systems, applications, privileged groups, service accounts, recovery methods, and external identities.
- Measure MFA enrollment, actual enforcement, fallback use, stale accounts, standing privilege, and authentication failures.
- Identify which applications support passkeys or FIDO2 and which still require weaker methods.
- Confirm that sign-in, mailbox, application-consent, and endpoint logs are retained and searchable.
Phase 2: Protect the highest-value paths
- Require phishing-resistant authentication for administrators and high-impact applications.
- Remove unnecessary privileged access and close unused accounts and application permissions.
- Enable post-delivery message removal, time-of-click URL checks, browser protection, and network blocking where available.
- Define alert ownership and an incident playbook that includes token revocation and mailbox inspection.
Phase 3: Expand and tune
- Roll the stronger authentication method to additional user groups after the pilot’s recovery and support issues are resolved.
- Retire weaker fallbacks where coverage permits, and document exceptions with an owner and an end date.
- Tune sign-in and mailbox alerts against normal travel, remote work, and service-account behavior.
- Exercise a realistic scenario: a user scans a QR code, approves a device code, and receives a malicious inbox rule. Confirm that responders can revoke access, find persistence, and determine data exposure.
Metrics that show whether the program is working
- Percentage of users and privileged accounts enrolled in a phishing-resistant method.
- Percentage of sign-ins that require that method, rather than merely allowing it.
- Number and age of stale accounts, unused application grants, and standing administrator assignments.
- Time from suspicious sign-in to investigation, containment, token revocation, and restoration of trusted access.
- Number of unauthorized mailbox rules, forwarding changes, MFA registrations, and application consents detected.
- Fallback and recovery rates, including how often users or help-desk staff bypass the intended control.
Common implementation failures and their fixes
“We turned on MFA, so phishing is solved.”
MFA coverage does not reveal whether users can be tricked into approving a request or whether a stolen token remains valid. Measure enforcement, method strength, fallback use, session controls, and token-revocation capability.
“We will require passkeys after every application supports them.”
Support is uneven, and waiting for a perfect estate leaves high-value accounts exposed. Protect supported administrators and applications first, document exceptions, and use compensating controls while unsupported paths are modernized.
“The employee changed the password, so the incident is closed.”
Investigate sessions, refresh tokens, device-code activity, mailbox rules, forwarding, delegates, and application permissions. Password rotation addresses only one possible access path.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →“Our filter blocked the original message.”
Messages can change classification after delivery, arrive through trusted services, or reach a user through a QR code or collaboration channel. Combine pre-delivery scanning with post-delivery purge, time-of-click checks, browser protection, and identity monitoring.
“A security key is a complete solution.”
A FIDO2 security key is a phishing-resistant authentication component, not a stand-alone security program. Verify identity-provider, device, application, enrollment, replacement, recovery, and deactivation support before deployment.
Choosing among passkeys and security keys
Compare options on more than unit price. For each candidate, document:
- Whether authentication is cryptographically bound to the intended relying party and resistant to phishing.
- Identity-provider and application support, including administrator, external-user, and shared-device workflows.
- Device availability, mobility, accessibility, and what happens when a device is lost or replaced.
- Enrollment verification, recovery, replacement, help-desk workload, and secure deactivation.
- Whether policy can require the method for the relevant sign-ins rather than merely display it as an option.
- Total deployment and support effort, including training and compatibility testing.
Choose the method that your organization can enforce and recover securely. A technically strong authenticator with poor enrollment or an easy fallback can create a false sense of protection.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
