GUIDE · 7 min read

Phishing Defense That Actually Works

Awareness training moved click rates a little. What moved them a lot was making credentials un-phishable and putting a real detonation layer in front of the inbox. Here is the stack that holds up against 2026 tradecraft.

Why modern phishing beats old advice

Attackers now proxy the real login page in real time (Evilginx, EvilProxy), so the victim walks through a genuine domain flow while the attacker captures the authenticated session cookie — MFA prompt included. QR-code 'quishing' moves the link onto an unmanaged phone, and callback / 'BazarCall' lures skip links entirely.

Kill the credential, not just the link

The single highest-impact control is phishing-resistant authentication.

FIDO2 / passkeys or hardware keys for all admins and email — AiTM proxies cannot replay them
Number-matching plus geo/context checks on any push MFA that remains
Conditional Access: block legacy auth, require a compliant device for token issuance
Short token lifetimes plus continuous access evaluation so a stolen cookie dies fast

Put a detonation layer in front of the inbox

Pre-delivery and post-delivery both matter.

Inline scanning that follows redirects and renders the final page (Sublime, Proofpoint, Abnormal, Defender for Office 365)
Automatic clawback of already-delivered mail when a URL later turns malicious
DMARC at p=reject with DKIM/SPF alignment to cut lookalike-sender volume
Banner external senders; strip or rewrite QR codes found in image attachments

Drill it like an incident

Run internal simulations that mirror current tradecraft — AiTM, quishing, callback — not 'you won a gift card'. Measure report rate, not just click rate: a fast report is the win. Wire the report button straight into your SOAR so it auto-triages and clawbacks the same campaign from every other mailbox.

Tools mentioned

GoPhishEvilginxSublime SecurityProofpointMicrosoft Defender for Office 365YubiKey

⟩ takeaway

You cannot train your way out of real-time AiTM phishing. Make authentication phishing-resistant, detonate links before and after delivery, reward reporting, and automate the clawback.

⟩ keep reading

Mobile Malware in 2026: How It Gets In and How to Stay Safer

Spyware, banking trojans and sideloaded RATs — how modern mobile malware lands on a device, the tools that detect it, and the habits that keep you off the target list.

Splunk Detection Tips: From Noisy Alerts to Real-Time Signal

SPL patterns, accelerated data models and tstats tricks that turn a slow, noisy Splunk into a near-real-time detection engine — with snippets you can paste in today.

EDR Tuning: Real Value from CrowdStrike, Defender and SentinelOne

Deploying an EDR is easy; making it stop attacks without drowning analysts is the work. Staged prevention policy, environment-specific custom detections, and real-time response done right.