Phishing in 2026: The QR Code, the Text Message and the Login Page That Steals Your Session

A parking invoice, a QR code and a mailbox that goes quiet

A property manager looking after 300 units gets a PDF on Wednesday titled "Unpaid parking invoice, Unit 14B." Tenants dispute parking charges every week, so she opens it. The PDF has the parking vendor's logo and a QR code with the words "scan to review and dispute." She scans it with her phone, because that is what you do with a QR code.

The page asks her to sign in to Microsoft 365 to view the document. She does. It even asks for the six-digit code from her authenticator app, and she types that in too. A spinner. Then the real invoice portal loads, and there is no invoice for 14B. She shrugs and goes to lunch.

By the time she is back at her desk, someone else is in her mailbox. Not with her password, which they also have, but with the session her browser handed over. Their first act is not to steal anything. It is to create a rule: any incoming message containing the word "tenant," "lease" or "deposit" is marked read and moved to an archive folder she never opens.

For the next eleven days, tenants who reply to her emails about deposits and move-out dates are getting answers. The answers are from the attacker, and they contain new bank details.

What the heck does this mean

Phishing is a message that pretends to be from someone you trust so you will do something you should not: click, sign in, pay, or call. In 2026 the message rarely looks like the badly spelled prince email your staff were trained on ten years ago.

Quishing is phishing by QR code. The code is a web address drawn as a picture, so text-scanning email filters cannot read it, and it pulls you onto your phone, where there is no filter at all.

Smishing is phishing by text message. Vishing is by phone call. Both work better than email because people trust their phones and answer quickly.

Adversary-in-the-middle, or AitM, is the fake login page in our story. It relays what you type to the real site in real time and pockets the session token the site returns. The token is the thing that says "this browser is already logged in." With it, the attacker does not need your password or your MFA code ever again.

Mailbox rule manipulation is the quiet follow-up: filters that hide the messages that would give the game away.

The numbers that matter

One in three emails is malicious or unwanted, phishing makes up 48% of the malicious ones, and 70% of malicious PDFs carried a QR code, according to the Barracuda 2026 Email Threats Report. Our parking invoice was not exotic. It was the standard model.

Phishing by text message or phone call achieved a 40% higher success rate than email in the simulations analyzed in the Verizon 2026 Data Breach Investigations Report. Your staff have been trained on the wrong channel.

Adversary-in-the-middle phishing accounted for 18.9% of identity attacks and mailbox-rule manipulation for 19%, per the Huntress 2026 Cyber Threat Report. Almost one in five identity attacks now walks straight through the MFA that owners think is protecting them.

What to do this week

1. Move the owner, the bookkeeper and anyone with admin rights to phishing-resistant MFA: a hardware security key or a passkey. These only answer the real website, so the fake page gets nothing. (CIS 6 Access Control Management)
2. Have IT list every mailbox rule that forwards, deletes or moves messages, review them with the mailbox owner, and turn on an alert for new ones. (CIS 9 Email and Web Browser Protections)
3. Turn on the setting in your email platform that blocks or quarantines PDFs and images containing QR codes for staff who have no business reason to receive them. Most platforms added this in the last two years. (CIS 9 Email and Web Browser Protections)
4. Retrain in one short session on the three new forms: QR codes, texts and phone calls. Show the real thing. Ten minutes on Thursday beats an hour-long video once a year. (CIS 14 Security Awareness and Skills Training)
5. Set a session lifetime on your cloud accounts so a stolen token expires in hours, not weeks, and require a fresh sign-in from any new device. (CIS 5 Account Management)
6. Give staff one address or button to report a suspicious message, and answer every report the same day, including the false alarms. Silence trains people to stop reporting. (CIS 14 Security Awareness and Skills Training)

Where AccuSights fits

Our assessment tests the settings behind this story: whether your MFA can be relayed, how long a stolen session stays valid, and whether anyone would notice a new forwarding rule. The Cyber Hygiene Test takes three minutes and shows the gap. For a human view of what to fix first, book 15 minutes with an engineer.

Questions people ask

Can a QR code be a phishing attack? Yes, and it is now one of the most common forms. A QR code is just a web address drawn as a picture, so email filters that read text cannot see where it points. The code also moves you from a managed work computer to a personal phone, which usually has no protection at all. Treat a QR code in an email or PDF the way you would treat a link from a stranger.

What is adversary-in-the-middle phishing? It is a fake login page that sits between you and the real service and passes your typing through in real time. You enter your password and your MFA code, the real site accepts them, and the attacker keeps the session token the site hands back. From that moment they are you, without needing your password again. It defeats codes sent by text or app, but not hardware keys or passkeys.

Does MFA stop phishing? Text-message and app codes stop the old kind, where the attacker only had your password. They do not stop adversary-in-the-middle pages, which capture the code along with everything else. Phishing-resistant MFA, meaning passkeys or hardware security keys, does stop it because the key will only answer the real website. Keep MFA on everywhere, and move the accounts that matter most to the resistant kind.

The best phishing email of 2026 will not ask you to do anything strange. It will ask you to do the thing you do every day, on the device you trust most.