Don't Make It Easy for Them: Where Phishing Awareness Stops Working
Key takeaways
Security awareness training remains important, but it can’t prevent every phishing attack. Attackers increasingly exploit legitimate authentication processes and familiar security habits, including those employees have been trained to follow.
MFA doesn't always stop account takeover. Device code phishing can trick users into completing legitimate authentication steps that grant attackers access, without requiring them to steal a password.
Recognizing a phishing site has become harder. Convincing copies of legitimate websites and mobile-only phishing pages can deceive users while evading conventional automated scanners.
Strong passwords cannot protect credentials or sessions that attackers have already stolen. Infostealer malware, credential theft, and session hijacking can bypass good password hygiene.
Organizations need a left-of-boom approach to phishing, removing threats before employees or customers ever encounter them. Continuous detection, rapid disruption, and phishing site takedowns provide protection that doesn't depend on someone recognizing an attack.
Every October, Cybersecurity Awareness Month brings the same advice to employees, customers, and the marketing teams who help carry the message.
The National Cybersecurity Alliance toolkit centers on five behaviors: long unique passwords, a password manager, multi-factor authentication (MFA) everywhere, updated software, and a second look at unexpected messages. They are the same five as last year, and the year before that.
However, while the advice has held up, phishing techniques haven’t stood still. The Anti-Phishing Working Group (APWG) counted 425,808 phishing attacks in June 2026, the highest monthly total in over three years, and attackers increasingly build their lures around the very habits the campaign promotes, including some designed to succeed even when a user does everything right.
That leaves anyone responsible for awareness messaging with an uncomfortable question: What should we tell people when following the advice correctly can end up playing into attackers’ hands?
When MFA is enabled, but the account opens anyway
Every awareness campaign leads with MFA, and for good reason. A stolen password on its own will not open an account when a second authentication factor is required. But MFA doesn't prevent every type of account takeover, particularly when attackers trick users into authorizing access themselves.
Threat actors have built techniques to get the code anyway.
The EvilTokens case
Earlier this year, Netcraft observed a wave of device code phishing attacks, spurred by the phishing-as-a-service toolkit EvilTokens, to impersonate trusted devices. This is how it worked:
Attackers send a lure (typically via a phishing email) to the victim containing a link or attachment “requiring login.”
The victim logs in through the legitimate service and enters a device code generated by the attacker's infrastructure.
The attacker gains access to the “authorized” device when the victim enters the device code.
This attack technique abuses the OAuth 2.0 device authorization flow, meaning the victim authenticates legitimately at microsoft.com/devicelogin, and the authorization server issues tokens to the attacker's polling client.
The lure creates a sense of urgency around a routine login request. The victim sees a legitimate Microsoft authentication page, completes the expected security steps, and unknowingly authorizes the attacker's device.
Microsoft’s policy for a 15-minute expiration of device codes usually breaks these kinds of campaigns. The code embedded in a phishing email has often already expired by the time the victim opens it.
In this attack, however, cybercriminals used EvilTokens to generate the code on page load, which then dynamically requests a fresh device code the moment the victim opens the lure. That means the code doesn’t expire before victims can use it.
EvilTokens is not an isolated incident: Netcraft disrupted GhostPairing relay infrastructure in March 2026, which applies the same post-authentication technique to WhatsApp and Signal device pairing.
Authorization is not authentication
The key failure here is that OAuth grants access, but it doesn’t prove identity. True authentication happens first, and OAuth merely carries that established session forward. It doesn’t add much in the way of security to the authentication step, and isn’t phishing-resistant.
Check out our passkeys guide for a rundown on what’s next for phishing-resistant authentication now that attackers have ways to bypass MFA.
When the user checks the page, but the page checks back
Checking for suspicious web page content used to be one of the simplest ways to catch a scam. Attackers have since become good enough at copying legitimate page content that inspection on its own no longer catches phishing attacks. This sudden maturation in sophistication could be attributed to the incorporation of AI in these attacks.
Take last year’s flood of fake tax refund websites, for example.
In the weeks before the Oct. 15 U.S. IRS tax filing extension deadline, Netcraft found that a threat actor deployed at least 850 newly registered domain names to target people in the US and elsewhere with phishing links that use tax refunds or toll road charges as a lure. They primarily used SMS-based phishing (aka “smishing”) techniques to deliver these lures, sending victims text messages containing the malicious link.
The phishing sites themselves closely matched the design and appearance of the impersonated government agencies' websites. Many of them pulled the real gov.uk banner logo directly from the official site, and the attackers named state and local tax authorities correctly almost every time, free of misspellings.
Victims who visit these phishing sites could end up handing over personal and financial information, including Social Security numbers and other personally identifiable information (PII), to phishing sites that looked almost identical to legitimate government pages. With that information, attackers could pursue further fraud or identity theft.
When the password is long and unique but still turns up
The password advice is the oldest of the five and the arithmetic behind it is sound. The longer and more unique the password, the less likely an attacker is to guess or crack it. What the arithmetic describes is a cracking attack.
Many cyberattacks no longer require attackers to guess passwords. Infostealer malware, breach dumps, and session theft give criminals access to credentials that may be long, unique, and perfectly compliant with company password policies.
According to the Verizon Data Breach Investigations Report (DBIR) 2026, stolen credentials are one part of a broader pattern: credential abuse appears somewhere in the attack chain in 39% of data breaches, even though it has slipped to third place as a first point of entry.
Length buys nothing against an attacker who already holds the credential. Once it has fallen into cybercriminals’ hands, credential hygiene shrinks the blast radius. But it cannot stop an attacker who already holds a valid, pre-authenticated session token.
What awareness campaigns teach | The technique that routes around it |
Enable MFA | Device code phishing: the victim completes real MFA at the genuine login page, and the attacker’s device receives the tokens. |
Look for suspicious content | Fake pages pull real content from the official site and name the imitated brand correctly. |
Double check a URL before you click on a hyperlink | Pages load only for mobile browsers, so the check lands on a page assembled from the genuine site. |
Use long, unique passwords | Attackers skip guessing and use credentials from infostealers, breach dumps, and session theft. |
Before the phishing awareness program
Security awareness training still has a place. Employees need to recognize suspicious emails, unexpected phone calls involving vishing, and other common cybersecurity threats and social engineering tactics. Phishing simulations can help them practice those decisions in a controlled environment.
But the attacks covered here show how much cybercriminals have learned to work around those habits. EvilTokens exploits legitimate authentication flows, mobile-only phishing sites hide from automated scanners, and stolen session tokens can give attackers access without needing a password. None of these attacks depend on someone ignoring their security training.
Organizations also need to detect and disrupt the cybercrime infrastructure behind phishing campaigns, including attacks that employees may never have a chance to recognize.
Netcraft's Domain Takedown Service detects, validates, blocks, and removes phishing domains and malicious websites at scale. We analyze more than 23 billion data points annually to identify and validate online threats. That intelligence has powered more than 25 million phishing domain takedowns, 220 million cybercrime blocks, and an average phishing website removal time of 33 minutes.
Awareness training gives people a better chance of recognizing an attack. Taking down the infrastructure gives attackers fewer opportunities to reach them in the first place.
See how Netcraft disrupts phishing infrastructure.
FAQs
What is device code phishing and why does it get past MFA?
Device code phishing tricks a victim into entering an attacker-generated code at a legitimate login page, such as microsoft.com/devicelogin. It abuses the OAuth device authorization flow, which lets devices sign in after a user approves the login on a second device. The victim completes MFA, and Microsoft issues tokens to the attacker’s device.
Can security awareness training stop phishing on its own?
No. Employee training and phishing awareness programs can reduce the risk of low-effort campaigns and bolster good behavior like reporting suspicious emails that help contain threats faster, but attackers have designed techniques that exploit the advice these programs offer. Phishing awareness training is a baseline. Removing the infrastructure behind the attack is what operates independently of user behavior.
Why do some phishing pages only load on mobile devices?
Attackers restrict pages to mobile devices to avoid detection. Many security scanners crawl with desktop User-Agents, or those limited to a certain language or region, so a page that refuses those visitors stays invisible to them.
What is phishing-resistant authentication?
Phishing-resistant authentication cryptographically binds each login to the legitimate website, so users can’t hand credentials or codes to a lookalike site. Passkeys and FIDO2 security keys are the two most common examples.
