Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Modern phishing is harder to spot by appearance alone: a message can be polished, fit a real business workflow, and lead through legitimate sign-in pages. Treat unexpected requests for money, credentials, or action as something to verify—not as trustworthy because they look familiar. If someone clicks, report it quickly and investigate what happened next.
Why modern phishing can look legitimate
Old warning signs still matter. Unexpected urgency, suspicious links, and poor spelling can all signal a scam. But their absence is not proof that a message is genuine. Attackers can use polished language, familiar context, and AI-assisted personalization to make a lure fit the recipient and the moment. ESET describes this shift in its September 28, 2026 article; that does not mean every well-written email is AI-generated.
As an Amazon Associate I earn from qualifying purchases.
Instead of relying on a single visual clue, ask whether the requested action makes sense and verify consequential requests through a separate channel you already trust.
What newer phishing tactics look like
QR codes that move the check to another device
A QR code can hide a malicious link in an email image. Unlike a text link, it cannot be inspected by hovering over it, and the recipient may scan it with a personal phone outside the protections and monitoring of a managed computer. ESET says QR-code phishing accounted for one in nine phishing emails in its detected sample in the first half of 2026. That is ESET telemetry, not an estimate of all email traffic.
Sign-in flows that target an existing session
In the ConsentFix technique described by ESET, a compromised legitimate website directs a person through a real Microsoft sign-in and OAuth authorization flow, then asks them to paste a resulting URL back into the site. An attacker can extract the authorization code and exchange it for access and refresh tokens. If the person already has an authenticated Microsoft session, the described flow may not prompt for a new password or another MFA challenge. This is a specific abuse pattern, not evidence that OAuth or MFA is generally unsafe.
Fake prompts that ask people to run commands
ClickFix and similar lures use fake errors, CAPTCHA pages, help screens, or troubleshooting instructions to persuade someone to paste or run a command. ESET reports that its HTML/FakeCaptcha detections grew 108% from the second half of 2025 to the first half of 2026, while remaining below the initial ClickFix surge it reported in the first half of 2025. A page asking you to run a command to fix a browser or verify that you are human is a reason to stop and contact IT through a known route.
ESET also describes CrashFix, in which a fake ad-blocker extension listed in the official Chrome Web Store delays a bogus alert. The example does not mean that every extension in an official store is malicious; it does show why store presence alone is not a sufficient safety check.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Contextual fraud using voice or video
A convincing call or video can reinforce a fraudulent request, especially when it appears to come from a colleague or executive. ESET cites a reported deepfake call that preceded wire transfers exceeding US$25 million. That is an illustrative case, not a typical loss estimate. Treat voice or video as context, not as the independent verification channel for a high-value transaction.
How to check a suspicious work email
- Pause when the request is consequential. Unexpected payment instructions, changed bank details, requests for credentials, unusual QR codes, and pressure to act immediately deserve scrutiny—even if the message is well written.
- Verify through a separate, known-good route. Call the requester using a number from your company directory or an established record, or use the organization’s normal approval workflow. Do not rely on contact details supplied only in the questionable message. For payments or other sensitive actions, involve a second approver where policy allows.
- Do not use a message link or QR code as your test. If a request requires signing in, open the service through a known bookmark or your organization’s normal portal. If a page asks you to paste a URL or run a command, stop and ask IT to verify the procedure.
- Report it using the designated route. Use your company’s phishing-report button or security contact, and report rather than silently deleting the message. A report can help security staff find related messages or activity affecting other people.
What companies can do beyond awareness training
Make reporting easy and actionable
Tell staff exactly how to report suspicious messages, keep the process low-friction, and investigate reports. Training helps people recognize risks, but it cannot catch every polished or context-aware lure. Technical prevention and a practiced response are needed for the messages people do not recognize.
Use phishing-resistant authentication where services support it
FIDO2 combines WebAuthn and CTAP. Compatible browsers, platforms, and services can support FIDO2 authenticators, including external security keys over USB, NFC, or Bluetooth Low Energy (BLE). It is not automatically available for every account or application, so check service and identity-provider compatibility before adopting a method.
Organizations can consider a synced passkey on a platform or device, or a device-bound credential on a hardware key. The right choice depends on supported services, use of shared devices, enrollment, and how lost credentials are replaced. A hardware key needs a compatible connection and a backup and recovery plan. Make recovery itself resistant to phishing; a secure primary authenticator can be undermined by an easy-to-abuse account recovery process. FIDO discusses these deployment considerations in its enterprise guidance and FIDO2 overview. A security key is one layer, not protection against every attack that occurs after authentication.
Control sessions and prepare for post-click investigation
Because some attacks aim to exploit an existing authenticated session, organizations should consider session controls alongside login protections. If an employee clicks, the event is an opening for investigation, not proof by itself that an account or device is compromised. Security teams need to assess what happened next and be able to contain affected sessions or accounts when warranted.
That assessment may require connecting identity, endpoint, network, and file activity across devices and accounts. ESET recommends combining automated analysis with analyst investigation so weak signals can be correlated and contained quickly. Organizations can use in-house monitoring or a managed detection and response service to add investigative capacity; the choice depends on operational needs, and the cited material does not establish a vendor comparison.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to interpret the incident and survey figures
ESET says almost 70% of security incidents in its 2026 article occurred during typical business hours, and 90% occurred on workdays. These are ESET telemetry figures, not universal rates. Its 2026 SMB Cyber Readiness Index surveyed 4,400 decision-makers: 41% said investigations were completed within a fortnight, while another 34% said they took two to six weeks. Those are survey findings, not benchmarks for every organization. The figures underline the value of having a reporting and response process, but they do not predict how long a particular phishing incident will take to resolve.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
