TLDR
Phishing has moved far beyond typos and dodgy URLs. Attackers now use polished, AI tailored language, QR codes that hide destinations, and tricks like ConsentFix and ClickFix that hijack legitimate Microsoft or Google sign in flows....
How it works
Phishing has moved far beyond typos and dodgy URLs. Attackers now use polished, AI tailored language, QR codes that hide destinations, and tricks like ConsentFix and ClickFix that hijack legitimate Microsoft or Google sign in flows....
Red flags
- An email asks you to scan a QR code with your phone, bypassing desktop security controls You are asked to paste a long URL or command into a browser or terminal to "fix" a login or error A seemingly legitimate site requests OAuth consent or asks you to paste a redirect URL back into the page
What to do
- 1Treat every unexpected QR code in email as suspicious and verify the request on a separate channel Never paste commands, OAuth codes or redirect URLs into pages you did not independently navigate to Enable token binding or phishing resistant MFA (FIDO2/security keys) and report suspicious lures to IT immediately
Source
welivesecurity
Source reviewed by Mythos Forensic Team
https://www.welivesecurity.com/en/business-security/devil-email-wearing-new-mask/FAQ
Is Modern phishing evades traditional red flags with QR codes, AI lures and token theft a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
An email asks you to scan a QR code with your phone, bypassing desktop security controls You are asked to paste a long URL or command into a browser or terminal to "fix" a login or error A seemingly legitimate site requests OAuth consent or asks you to paste a redirect URL back into the page
What should I do first?
Treat every unexpected QR code in email as suspicious and verify the request on a separate channel Never paste commands, OAuth codes or redirect URLs into pages you did not independently navigate to Enable token binding or phishing resistant MFA (FIDO2/security keys) and report suspicious lures to IT immediately
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.