What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enabling multi-factor authentication (MFA) does not guarantee that a company email account is safe from phishing. Adversary-in-the-middle (AiTM) attacks can proxy a sign-in and capture its authentication token, while device-code phishing can trick a person into authorizing an attacker’s session. Microsoft’s 2026 Digital Defense Report points to a broader response: use phishing-resistant authentication, tighten identity and email controls, and connect signals across security systems.
What Microsoft’s figures say—and what they do not
Microsoft reports that it detected more than 46 million business email and contact impersonation attacks in its past-12-month observation. It also says 89–95% of email phishing attachments led to a credential-theft effort, and that its Defender for Office 365 service detected more than 145 million QR-code phishing attacks between July 2025 and June 2026. Separately, Microsoft says 52.2% of valid-account intrusions involved follow-on credential theft. These are Microsoft’s telemetry figures and categories, not independently established rates for every organization or email-security provider.
As an Amazon Associate I earn from qualifying purchases.
The report’s central point is that email phishing is part of a wider identity and trusted-access problem. Microsoft puts it this way: “Identity is the primary control plane for defense.” That framing matters because a stolen session can provide access even when a password and an MFA prompt were part of the login.
Free tools Windows power users keep installed
One-click scans. No signup required.
How an attack can get past conventional MFA
AiTM proxies a legitimate sign-in
In an AiTM attack, a phishing site sits between the user and the real sign-in service. The user interacts with a page that relays the authentication exchange to the legitimate service. If the attacker captures the resulting session token, they may be able to use the authenticated session without repeating the original sign-in.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft’s April 2026 campaign analysis describes this method: attackers proxied authentication and captured tokens, enabling account access despite non-phishing-resistant MFA. The reported campaign targeted more than 35,000 users across more than 13,000 organizations in 26 countries; 92% of targets were in the United States. Those numbers describe that campaign, not phishing generally.
Device-code phishing abuses a different flow
Device-code flows are legitimate ways to authorize a device or application. In a phishing scenario, an attacker starts a real flow and presents the resulting code through a lure. If the user enters that code at the legitimate authorization page, the user may authorize the attacker’s session rather than their own device.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
This is distinct from proxying a browser sign-in. Microsoft recommends blocking device-code flow where possible. If a business use case requires it—for example, some Teams devices—exceptions should be narrowly scoped to the necessary resource accounts and policy conditions rather than left broadly available.
Why mailbox access can outlast the initial login
A stolen token is not merely a way to get through the front door. Microsoft’s September 2026 EvilTokens analysis describes post-compromise activity including mailbox access, email exfiltration, malicious inbox rules that hide activity, possible device additions, and use of mailbox contents to write more convincing follow-on phishing. Microsoft attributes more than 12,000 compromised inboxes across over 10,000 organizations worldwide to campaigns facilitated by the EvilTokens platform.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
That sequence can turn one compromised account into a persistence and impersonation problem: attackers may conceal messages, learn how a business communicates, and target coworkers or external contacts from a trusted account. The cited analysis is Microsoft’s account of its investigation and the platform’s activity; it is not a controlled comparison or a universal measure of mailbox compromise.
What to change in company email and identity defenses
Make authentication phishing-resistant
Microsoft’s guidance calls for phishing-resistant authentication, including FIDO2 security keys and passkeys, with Conditional Access policies to enforce the intended protection. Microsoft Learn summarizes its position: “Traditional MFA is no longer enough—phishing-resistant MFA is the new baseline.”
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
When selecting an option, check whether it is bound to the legitimate service and device context, whether the organization’s identity provider and endpoints support it, and how enrollment, recovery, and policy enforcement will work. A FIDO2 key is a physical option, but compatibility depends on the organization’s identity provider and supported devices; no single key should be assumed to work everywhere.
Recommended Free Tools
Reduce standing privilege and identity exposure
Microsoft recommends disciplined identity hygiene, tiered administration, limits on standing and privileged access, and strong controls for privileged accounts. The practical aim is to reduce the access available to an account or session that is compromised, and to avoid leaving elevated permissions permanently active when they are not needed.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Keep email protections in place
Authentication is not a substitute for email security. Microsoft recommends anti-phishing protections and correct configuration of essential email security settings. Its campaign and EvilTokens analyses also discuss mail-flow rules and spoof protections. These controls can help address impersonation and suspicious messages, but they should be treated as one layer alongside resistant authentication and identity controls.
When evaluating email defenses, consider spoof and impersonation protection, URL and attachment handling, investigation visibility, integration with identity and endpoint signals, and operational fit. The cited Microsoft material does not provide controlled comparative tests of email-security products.
Connect signals across systems
Microsoft recommends cross-correlating endpoint, identity, cloud, application, email, and network telemetry. A suspicious inbox rule may look less significant in isolation than when linked to a risky sign-in, an unfamiliar device, or endpoint activity. Connecting these signals can help reveal attack patterns that separate tools or teams might otherwise miss.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A practical order for reviewing protections
- Check authentication coverage. Identify which company email accounts use phishing-resistant methods, and whether Conditional Access or equivalent policy enforcement requires them where appropriate.
- Review device-code access. Determine whether device-code flow can be blocked. If a real business requirement prevents a full block, constrain exceptions to the specific resources, accounts, and conditions needed.
- Inspect privilege and persistence controls. Review standing administrative access, privileged-account safeguards, and monitoring for unexpected devices or mailbox rules.
- Verify email protections. Confirm anti-phishing, spoof, mail-flow, URL, and attachment controls are configured for the organization’s environment.
- Test how investigations join evidence. Check whether analysts can connect email events with identity, endpoint, application, cloud, and network signals when investigating an account.
The order starts with the identity paths that can defeat conventional MFA, then addresses the mailbox and investigation paths that can let a compromise continue. The specific policy settings depend on the organization’s identity provider, devices, and legitimate authentication workflows.
How to interpret the report for your organization
Microsoft’s 2026 report and campaign write-ups are useful for understanding techniques and Microsoft-observed activity, but the figures should not be read as a forecast for an individual company. The cited pages do not establish independent cross-vendor prevalence, show that every MFA-bypassing attack uses AiTM, or compare defenses under controlled conditions. Use the reports to identify attack paths worth reviewing—not to infer your organization’s likelihood of compromise from global telemetry.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
