The article describes how real-world phishing and social engineering are evolving to bypass the checks employees are trained to use (bad grammar, suspicious URLs, obvious fake login pages). It highlights specific, observed attack workflows including QR-code “device hop” phishing, OAuth token theft via ConsentFix, and deepfake-enabled business email compromise (BEC) leading to large fraudulent wire transfers.
This breakdown covers three real-world social engineering patterns that succeed precisely because they avoid the tells employees are trained to spot. Rather than bad grammar or obviously fake login pages, attackers are using legitimate-feeling workflows to move past both technical and human defenses.
The first is QR-code phishing, sometimes called a device hop. An email embeds a QR code instead of a clickable link, so there is no URL to hover over and inspect. Scanning it on a phone also moves the interaction off a managed laptop, away from corporate security controls and often away from visibility for defenders entirely.
The second is ConsentFix, which abuses a real Microsoft sign-in flow. A victim lands on a compromised but legitimate website, completes a fake CAPTCHA-style prompt that routes them through an authentic Microsoft login, and is then told to paste a resulting URL back into the page. That URL contains an OAuth authorization code, which the attacker exchanges for access and refresh tokens. If the victim already has an active session, no password or MFA prompt appears at all.
The third involves deepfake audio and video used in business email compromise. A finance employee joined a call populated by what appeared to be senior colleagues, and the realistic context was enough to result in large fraudulent wire transfers.
Each technique targets an assumption defenders rely on. QR codes remove the ability to visually inspect a link. ConsentFix uses a genuine identity provider flow, so the page a victim interacts with is real, only the surrounding context is fraudulent. Deepfakes remove voice and video as reliable identity signals, so a recognizable face or voice no longer proves who is actually on the call.
Organizations should treat polished, familiar-looking messages as unverified until confirmed through a known-good channel. High-stakes actions like wire transfers deserve out-of-band verification and, where possible, a second approver, since voice and video recognition alone is no longer sufficient evidence of identity. Security teams should also train users to recognize OAuth consent and QR code traps specifically, not just outdated fake-login indicators, and encourage reporting of suspicious emails rather than silent deletion so broader campaigns can be detected earlier.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The destination URL is hidden inside the QR code, so there is nothing to hover over before scanning, and the code is typically scanned on a personal phone, bypassing the security controls that protect company-issued laptops.
ConsentFix routes victims through a real Microsoft sign-in flow via a fake CAPTCHA-style prompt, then has them paste back a URL containing an OAuth authorization code, which the attacker exchanges for access and refresh tokens without triggering an MFA prompt if a session is already active.
Yes, the article cites a case where a finance employee joined a call populated by deepfake versions of senior colleagues and still ended up making wire transfers worth more than US$25 million.
Require out-of-band verification and a second approver for high-stakes payment requests, and train employees to recognize QR code and OAuth consent traps rather than relying only on spotting bad grammar or fake login pages.
Phishing isn’t broken English anymore. It’s clean emails, QR codes, real Microsoft screens, even deepfake voices on a call. One in nine phishing emails now use a QR code: 'Please scan the QR code to continue.' You scan on your phone, the URL’s hidden, and you’ve just stepped outside our laptop security. Or you hit a legit site, see a fake CAPTCHA, get bounced through a real Microsoft sign-in, then it says: 'Paste this URL back here.' That’s ConsentFix stealing your OAuth tokens without even asking for MFA. Here’s the move: if anything pushes you to scan a QR, paste a URL, or move fast on a payment, stop and report it in the phishing button or security channel, don’t just delete it.
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
A real-world social engineering attempt used a legitimate Google Doc to trick a target into manually running commands that installed malware. The attacker posed as a crypto marketing executive and used a fake “decryption failure” message and a “manual update” button as the lure, leading to an…
Attackers are sending fake ChatGPT billing emails that pressure people to “update payment” within 48 hours to avoid service interruption. The message links to a convincing look‑alike ChatGPT login page via a Google redirect, aiming to steal OpenAI credentials.
Anthropic says it disrupted a Russian state-linked campaign that used Claude to continuously rebuild malware when security tools detected it. The group (GTG-20006, linked to Midnight Blizzard/APT29) ran phishing and other human-targeted schemes, including device-code token theft against Microsoft…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
