--- title: 'Security Trends' url: 'https://www.securteksecurity.com/security-trends' markdown: 'https://www.securteksecurity.com/security-trends.md' date: '2026-10-14' description: "SECURTEK SECURITY · THREAT BRIEFINGSecurity TrendsThe threats people don't see comingMost security advice tells you to use strong passwords and turn on multi-factor authentication. That is good advice, but it is no longer enough. The attacks below are growing precisely because most people have neve…" --- # Security Trends ![Security operations monitoring](https://upload.wikimedia.org/wikipedia/commons/7/71/Combined_Space_Operations_Center_%28CSpOC%29_staff_monitors_workstations_%28Screen_images_have_been_altered_for_operational_security%29_%289169412%29.jpg)SECURTEK SECURITY · THREAT BRIEFING Security Trends The threats people don't see coming Most security advice tells you to use strong passwords and turn on multi-factor authentication. That is good advice, but it is no longer enough. The attacks below are growing precisely because most people have never heard of them, and each one targets something ordinary: a parking meter, a search result, an "I'm not a robot" checkbox, an app permission, or an approval tap on your phone. Here is what to know, and what you can actually do about it. 331% year-over-year increase in QR-code phishing campaigns (Cofense, via Allure Security) 47% of initial-access cases in 2025 attributed to ClickFix fake-CAPTCHA techniques (Microsoft Defender experts) $14.6M in losses tied to sponsored search ads impersonating banks (U.S. Department of Justice case) ## 1. Quishing: QR-code scams are everywhere now Quishing is phishing through QR codes. You scan a code that looks legitimate, on a parking meter, a restaurant table, a delivery notice, or in an email, and it takes you to a malicious website designed to steal your login credentials or payment details. The code itself is harmless. The link inside it is the attack. Why it matters to you: scammers have pasted fake QR stickers over real ones on parking meters and restaurant menus, and sent fake invoice and payroll emails with QR codes that lead to spoofed Microsoft and Google login pages. Because the malicious link hides inside an image, many email filters miss it. The FBI issued a flash alert on QR-code spearphishing campaigns by North Korea's Kimsuky group, and the FTC has warned about traffic-violation texts that include QR codes. One security firm reported a 331 percent year-over-year increase in QR-code phishing campaigns (Cofense data, via Allure Security). Watch Professor Fehr's video on the topic, currently featured on the SecurTek homepage: [Watch: Professor Fehr on QR-code scams](https://www.youtube.com/watch?v=kVaZfg_lwc0) **What you can do:** - Before scanning a QR code in a public place, look for a sticker pasted over the original code. - After scanning, preview the URL before opening it. If it bounces through shorteners or looks unfamiliar, close it. - If a company sends you a QR code, go to their official website or app directly instead of scanning it. - Never enter login credentials or download files after scanning a QR code unless you are certain of the source. Sources: [FBI quishing flash alert on Kimsuky QR spearphishing](https://alluresecurity.com/blog/quishing-qr-code-phishing/) and [FTC warning on QR-coded traffic-violation texts](https://pmcaonline.org/qr-code-scams/) ## 2. Fake CAPTCHA pages that turn you into the attacker A newer social-engineering trick, called ClickFix, works like this: you land on a page with a familiar "Verify you are human" checkbox. You click it, and instead of a puzzle you get instructions telling you to press the Windows key plus R, paste something, and hit Enter "to complete verification." The page silently copied a malicious command to your clipboard. Running it downloads malware, often an information stealer or remote-access trojan, straight into your computer's memory where antivirus may never see it. Why it matters to you: these attacks run on compromised legitimate websites, including small business and news sites, so the page you are on can look entirely trustworthy. They target Windows, macOS, and Linux users. Microsoft's Defender experts attributed 47 percent of initial-access cases in 2025 to ClickFix techniques (reported by The Hacker News via Hunt.io data). No exploit is needed. The attacker needs you to type the command. **What you can do:** - A real CAPTCHA never asks you to press Windows+R, open a terminal, paste anything, or run a command. Treat that request as a confirmed attack. - If a verification page looks off, close the tab and reach the site through your bookmark or a fresh search instead. - Report the suspicious page to your IT team so they can warn others. Sources: [SMU security explainer](https://blog.smu.edu/itconnect/2026/04/23/captcha-isnt-real-clickfix-attacks/) and [The Hacker News on ClickFix campaigns](http://thehackernews.com/2026/01/clickfix-attacks-expand-using-fake.html) ## 3. The top search result for your bank may be a scam ad Criminals now buy sponsored search-engine ads that impersonate real banks, software companies, and service providers. You search for your bank, a result appears at the very top labeled "Sponsored," the wording looks right, and you click before checking the address. That click lands on a fake login page built to capture your credentials and authentication codes. Why it matters to you: this is not a theoretical risk. In 2025, the Justice Department charged a group that purchased sponsored search links imitating legitimate banks, directing victims to fraudulent login pages; the DOJ tied at least 19 victims and about $14.6 million in actual losses to that operation. Researchers at Push Security also documented campaigns impersonating Ahrefs and other software brands through Google Search ads, with clones redirecting to fake Google sign-in pages. **What you can do:** - Type your bank's address directly or use a saved bookmark. Do not search for it each time. - Slow down before clicking any sponsored result. Check the actual destination domain character by character. - A sponsored result is a paid placement, not a mark of trust. Treat it as one more thing to verify. Sources: [DOJ bank-login ad case](https://cyberguy.com/scams/scammers-buying-google-ads-steal-bank-logins/) and [Push Security on Google Search malvertising](https://pushsecurity.com/blog/google-search-malvertising-campaign-continues-now-impersonating-ahrefs) ## 4. The "Allow" button can be the attack: OAuth consent phishing You have seen this screen: "Allow this app to read your email and contacts?" It is the normal permission prompt from Microsoft, Google, or another cloud provider. In consent phishing, the screen is genuine, but the app asking is not. An attacker registers a malicious application with a convincing name, like "Microsoft 365 Backup" or "DocuSign Integration," and sends you a link, often by direct message, that brings up the real provider's consent screen. If you click Allow, the attacker's app gets persistent access to your email, files, or contacts. Why it matters to you: the FBI issued a public service announcement on OAuth consent phishing in September 2026, noting the scheme has been active since late 2025 and targets prominent individuals, their family members, and acquaintances through direct messages on commercial messaging apps. The cruel detail: a password reset alone does not remove the access, because the grant is tied to the application, not your password. Victims must revoke the app directly in their account security settings. **What you can do:** - Read every permission screen before clicking Allow. If an app asks for email or file access and you were not expecting it, deny it. - If someone sends you an invitation, file share, or event link you did not expect, verify the sender through a separate channel first. - Review the list of apps connected to your Microsoft and Google accounts every few months, and remove anything you do not recognize or no longer use. Sources: [FBI OAuth consent phishing warning](https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/fbi-aha-warn-of-oauth-consent-phishing-scheme/) and [technical explainer](https://www.inforcer.com/insights/oauth-consent-phishing-explained) ## 5. MFA push bombing: when "Approve" becomes the weak link Many accounts protect you with a push notification: your phone buzzes, you tap Approve, you are in. Attackers who already have your stolen password can trigger that prompt over and over, dozens of times, until exhaustion, annoyance, or a fake "IT support" message convinces you to tap Approve just to make it stop. One tap is all they need. Why it matters to you: this is how the September 2022 Uber breach happened. An attacker linked to the Lapsus$ group obtained a contractor's password, flooded the contractor's device with MFA push notifications, then messaged the contractor posing as Uber IT support. Once the contractor approved a prompt, the attacker reached Uber's internal Slack, VPN, and other tools. Microsoft has observed thousands of MFA fatigue attempts per day, and the technique now has its own entry in the MITRE ATT&CK framework, which tracks methods common enough in real intrusions to warrant a name. **What you can do:** - Never approve an authentication prompt you did not just trigger yourself. An unexpected prompt means someone is trying to log in as you. Tap Deny and report it. - If prompts arrive in a burst, treat it as an active attack: deny them, contact your IT team, and change your password from a trusted device. - Where your accounts allow it, switch from simple tap-to-approve to number matching or a hardware security key, both of which resist push bombing. Sources: [Uber 2022 case breakdown](https://securew2.com/blog/what-is-mfa-fatigue-and-how-do-attackers-exploit-it) and [push bombing mechanics](https://securityboulevard.com/2026/07/what-is-mfa-fatigue-push-bombing/) ## Prepare before you need to respond These trends share one theme: the attacks that work are the ones nobody saw coming. SecurTek Security builds Incident Response Programs that prepare organizations for exactly this kind of surprise, with clear roles, tested playbooks, and response plans in place before an incident happens. If your team is relying on assumptions rather than a plan, now is the time to fix that. [Contact SecurTek](https://www.securteksecurity.com/contact) to start the conversation. --- ## Navigation - Previous: [Academic Research & Emerging Technologies](https://www.securteksecurity.com/research.md) - Next: [Tell Me What You're Dealing With](https://www.securteksecurity.com/project-inquiry.md)