Eight years ago, we wrote a guide on identifying malicious emails. The fundamentals haven't changed — but the attacks have gotten dramatically better. AI can now write convincing phishing emails at scale. QR codes bypass link scanners. Attackers target your phone's push notifications instead of your inbox. The old advice still works, but it needs an update.
Here's what phishing looks like in 2026, and the four steps that still stop it.
What's new in 2026
The core mechanism of phishing hasn't changed: someone tricks you into doing something you shouldn't. What's changed is how convincing the trick has become and how many new surfaces there are to attack.
| Threat | What it looks like | Why it's new |
|---|---|---|
| AI-generated phishing | Perfectly written, personalized email from your "CEO" asking for a wire transfer | LLMs produce flawless grammar and tone — no more typos to spot |
| QR code phishing (quishing) | QR code in an email that leads to a credential harvesting page | Bypasses link scanners and email filters — the URL is hidden in an image |
| MFA fatigue attacks | Flood of push notifications at 11 PM hoping you tap "Approve" to make it stop | Exploits passwordless/MFA adoption rather than bypassing it |
| Deepfake impersonation | Voicemail or video clip of your boss instructing you to act urgently | $25/month tools can clone a voice from 30 seconds of audio |
| Cloud link attacks | SharePoint, Google Drive, or Dropbox link that looks legitimate | Hosted on real platforms — security tools can't easily distinguish from real shares |
For years, poor spelling and grammar were the easiest way to spot a phishing email. AI killed that. Modern phishing emails are often better written than legitimate ones. Don't rely on bad grammar as your detection method.
The 4 steps — updated for 2026
Phishing emails in 2026 don't come from obvious fake addresses. They use lookalike domains (micros0ft.com vs microsoft.com), compromised real accounts, and display name spoofing where the visible name is your CEO but the actual address is ceo@totally-not-a-scam.net.
- Check the actual email address, not just the display name. On mobile, tap the sender name to expand it — don't trust the preview.
- Look for lookalike domains — extra characters, swapped letters (0 for o, l for I), or country codes that shouldn't be there.
- Check if your organization uses DMARC. It won't stop everything, but it blocks most domain spoofing. Ask your IT team.
- When in doubt, verify through a second channel. If your boss emails you asking for something unusual, message them on Teams or call them. Don't reply to the email.
Links have always been dangerous. In 2026, they're often wrapped in QR codes specifically to evade email security scanners that check URLs. A QR code in an email is almost always a red flag — legitimate businesses rarely send them.
- Hover before you click. On desktop, hover over any link to see the real destination. If it doesn't match what's described, don't click.
- Treat QR codes in emails as suspicious by default. "Scan to verify your account" or "Scan to pay your invoice" — these are quishing attacks. Use your phone's camera to preview the URL before opening it in a browser.
- Watch for redirect chains. A link goes to a legitimate-looking page that immediately redirects to a fake login screen. Look at the final URL in your browser before entering anything.
- Type critical URLs manually. If your bank emails you about your account, go to your bank's website by typing the address — don't click the link.
The old advice was "don't open unexpected attachments." Still true. But in 2026, attackers are more likely to send you a legitimate-looking cloud sharing link — SharePoint, Google Drive, Dropbox — that leads to a credential harvesting page or a malicious file hosted on a platform your security tools trust.
- Cloud links need the same scrutiny as attachments. A SharePoint link from someone outside your organization is a red flag. Verify with the sender first.
- Executable file extensions are still dangerous:
.exe,.bat,.cmd,.vbs,.ps1,.jar,.scr. But also watch for.htm,.html, and.iso/.imgfiles — modern malware uses HTML smuggling and container files. - Macro-free Office files can still be malicious. Attackers have moved past VBA macros to exploits that don't require enabling macros at all. Keep your Office software patched.
- When someone shares a file with you, check the sharing notification in the actual platform (Teams, SharePoint, Google Drive) rather than clicking the email link.
Phishing relies on urgency. "Your account will be closed." "Action required immediately." "Are you in the office?" The goal is to make you act before you think. In 2026, attackers have added new pressure tactics:
- MFA fatigue (push bombing): Attackers who already have your password send dozens of MFA approval requests, hoping you'll tap "Approve" just to stop the notifications. If you get unexpected MFA prompts, deny them all and contact your IT team — your password may be compromised.
- Deepfake voice messages: A voicemail that sounds exactly like your CEO asking for an urgent wire transfer. If the request involves money or credentials, verify through a known channel.
- AI-personalized lures: Attackers scrape LinkedIn and company websites to craft emails that reference real projects, real colleagues, and real deadlines. The personalization is designed to make you lower your guard.
- Pretexting at scale: "I'm on a call and can't talk, but I need you to buy gift cards for clients" — now powered by AI so the follow-up messages feel natural and responsive.
If an email creates urgency, asks for something unexpected, or wants you to click a link / open a file / approve a request — stop and verify through a separate channel. That was true in 2018 and it's still true in 2026. The attacks got better, but the defense is the same: think before you act.
What your IT team should be doing
Individual awareness matters, but the best defense is layered security at the organizational level. If you're responsible for IT:
- DMARC, DKIM, and SPF — implement all three. DMARC enforcement (p=reject) blocks most domain spoofing attacks targeting your organization.
- MFA with number matching — push notifications alone are vulnerable to fatigue attacks. Number matching requires the user to see and type a number, proving they initiated the login.
- Conditional access policies — block logins from unexpected locations, require compliant devices, and flag impossible travel.
- Phishing-resistant MFA — FIDO2 security keys or passcodes eliminate phishing entirely for the accounts that matter most. Consider them for admin and finance accounts.
- QR code and image scanning — modern email filters can extract and scan URLs from QR codes inside images. Make sure yours does.
- Regular phishing simulations — test your team quarterly. Track who clicks and provide targeted training. One simulation per year isn't enough.
- Incident reporting culture — make it easy and blameless to report a suspicious email. The faster someone reports, the faster you can contain it.
The 30-second checklist
Before you click, open, or reply, run through this:
- Sender — Is the actual email address (not just the name) someone I know and trust?
- Expectation — Was I expecting this email, file, or link? If not, verify first.
- Urgency — Does it pressure me to act immediately? That's a red flag, not a feature.
- Destination — If there's a link or QR code, do I know where it actually goes?
If any of those are uncertain, don't act — ask your IT team. A 30-second verification beats a $354K incident.
Read our original 2018 guide for the fundamentals that still apply, and our stolen laptop incident response checklist for what to do when a device goes missing.
Free IT Assessment
Not sure where your IT stands? Get a free, no-obligation assessment of your infrastructure, security, and cloud setup.
Get Your Free Assessment →
