In partnership with
Hey,
Welcome back to The SecureByDefault Brief.
Last week we talked about how brand-new servers get probed within 24 hours. This week we are switching lanes to something even more common: the email that made it past your filter and is trying to talk to your users right now.
The twist is that modern phishing does not really look like phishing anymore. So this issue is about how to spot it when it stops being obvious.
The quick brief
Phishing used to be easier to laugh at. Weird grammar. Crooked logos. "Dear valued customer" energy. If you squinted at a message for two seconds, you could usually tell.
Now the emails are cleaner, the landing pages look correct, and some attacks route users through legitimate authentication flows on real Microsoft or Google login pages. There is nothing to catch with your eyes because there is nothing visually wrong.
The giveaway is no longer how the message looks. It is what the message is asking you to do.
If your phishing detection strategy is "I will know it when I see it," congratulations, you are now the firewall. Please hydrate.
Real attack breakdown: when the login page is real
The most dangerous phishing technique going right now is called device code phishing, and it works like this:
The attacker sends a message pretending to be IT support, HR, finance, DocuSign, or Teams. Something the target is used to seeing.
The message tells the user to enter a short code on a real Microsoft login page to "verify access" or "complete sign-in."
The user goes to
microsoft.com/devicelogin(a legitimate URL), enters the code, signs in with their real credentials, and completes MFA.The attacker, who initiated the device code request on their end, receives a valid access token for that user's account.
Microsoft documented a campaign in early 2026 using this exact flow at scale, with automation generating fresh codes on demand to work around Microsoft's expiration limits. Some of those compromises led to email exfiltration, malicious inbox rules, and follow-on reconnaissance through Microsoft Graph.
Here is why it is nasty: the victim never typed a password into a fake site. They completed a real sign-in on the correct domain. Their eyes had nothing to catch. They just authorized the wrong session for the wrong person.
It is like unlocking your front door because someone outside yelled "Maintenance." Confident voice. Clipboard energy. Still not maintenance.
Why this matters right now
Almost every modern initial-access technique now shares one theme: the login is real, the intent is not.
Device code phishing: real Microsoft login flow, wrong session.
OAuth consent phishing: real Microsoft or Google consent screen, malicious app on the other side.
ClickFix: real-looking CAPTCHA or verification page that convinces users to paste a command into their own terminal. The Center for Internet Security flagged this as one of the fastest-growing techniques of 2025, used for malware distribution, financial theft, and ransomware.
The pattern to remember: the attacker is not always stealing your password anymore. Sometimes they are convincing you to authorize the attack yourself.
That is why "look for the fake URL" advice is not enough now. The URL is often correct. The user is the vulnerability that gets pointed at.
Five red flags to actually teach people
Forget spelling mistakes. These are the patterns worth training on:
Urgency without context. "You must act in 15 minutes" is almost never how real internal comms work.
Unusual channel for the request. Payroll changes over Teams DM. Password resets by SMS. Contract signatures by WhatsApp. If the channel is new, be suspicious.
Asked to enter a code you did not request. If you did not start the login, do not finish it.
Asked to run, paste, or install something. Legitimate websites do not need you to open PowerShell to prove you are human.
The request bypasses a normal process. "The CEO needs gift cards, do not tell anyone" is a red flag, not a workflow.
Practical fixes you can apply this week
For your users
1. Retrain on behavior, not appearance. Ask people to slow down on any message that says "log in," "approve," "verify," "run," "paste," or "call this number." Those are the six verbs attackers rely on.
2. Verify money and access requests out-of-band. Any request involving payroll, wire transfers, password resets, admin access, or vendor changes gets confirmed through a separate trusted channel. Call a known number. Do not reply to the suspicious message. Do not use the phone number in the suspicious message.
3. Treat unexpected device codes as an incident. If a user gets a device code they did not request, that is a report-to-IT moment, not a "just ignore it" moment. Someone somewhere is trying to sign in as them.
For your admins
4. Move toward phishing-resistant MFA. CISA specifically recommends phishing-resistant MFA because SMS and app push notifications can be defeated by the exact techniques above. Prioritize passkeys, security keys (YubiKey and similar), and platform authenticators. Number matching helps when phishing-resistant options are not available yet.
5. Restrict device code flow if you can. Microsoft recommends disabling device code authentication for users who do not need it, and configuring Conditional Access to limit which apps and devices can use it. This is one of the highest-value changes for the least effort.
6. Audit inbox rules and OAuth grants after any suspected compromise. The most common post-compromise persistence tricks are (1) auto-forwarding rules that quietly copy inbound mail to an external address, and (2) an authorized OAuth app that keeps working even after the password is reset. Check both.
This week in "Please Don't Do That"
Someone, somewhere, is about to paste a mystery command into PowerShell because a website said "Verification failed."
Please do not let a fake CAPTCHA become your new IT administrator.
If a website ever tells you to copy, paste, and run a command to prove you are human, close the tab. Humans do not need PowerShell to identify traffic lights.
Tool worth knowing: MXToolbox Email Header Analyzer
Free, browser-based, and beginner-friendly. Paste in the full headers from a suspicious email and it breaks down the routing path, SPF, DKIM, DMARC results, and any relay delays.
It will not tell you "safe" or "evil" in one click. What it does is turn a wall of raw header text into something a human can actually read without needing three monitors and a mild headache.
The two things to look at first: does the "from" domain actually match the servers that sent the message, and did the authentication checks (SPF, DKIM, DMARC) actually pass?
URL: mxtoolbox.com/EmailHeaders.aspx
Checklist tie-in
Everything in this issue maps directly to the Email and Phishing Defense section of the SecureByDefault 25-Point Security Checklist. Specifically, these two items:
The team knows the red flags (urgency, unexpected attachments, payment changes, lookalike domains)
Financial requests are verified out-of-band with a phone call before any wire transfer or banking change
If you have not worked through the checklist yet, start there. It gives you the baseline before the weird stuff gets weird.
One question for you
Have you ever received a phishing message that looked almost real?
Hit reply and tell me what tipped you off. Bonus points if it involved a fake invoice, a suspicious Teams message, or a "CEO" who suddenly needed gift cards like it was a corporate scavenger hunt.
Talk soon,
Ron
Cloud and Cybersecurity Engineer, SecureByDefault
Speak naturally. Send without fixing.
Wispr Flow turns your voice into clean, professional text you can send the moment you stop talking. Not rough transcription you have to clean up. Actual polished text — ready for email, Slack, or any app.
Speak the way you think. Go on tangents. Change your mind mid-sentence. Flow strips the filler, fixes the grammar, and gives you text that reads like you spent five minutes writing it.
89% of messages sent with zero edits. Millions of professionals use Flow daily, including teams at OpenAI, Vercel, and Clay. Works on Mac, Windows, and iPhone.
Sources
Microsoft Threat Intelligence on device code phishing campaigns · Center for Internet Security on ClickFix social engineering · CISA guidance on phishing-resistant multi-factor authentication · MXToolbox Email Header Analyzer documentation · SecureByDefault 25-Point Security Checklist