Cybersecurity threats are changing rapidly in 2026, but one of the biggest lessons from recent security research is that attackers do not always need a sophisticated piece of malware to compromise an organization or individual.
Sometimes, they only need to convince someone to trust the wrong message, website, login request, application, or support person.
Artificial intelligence is making this social engineering problem more difficult. Security researchers are observing campaigns that use AI-themed lures, automated infrastructure, credential theft, malicious authorization requests, and increasingly convincing impersonation techniques.
Microsoft’s September 2026 threat intelligence reporting, for example, highlighted device-code phishing, AI-themed social engineering, passkey-themed attacks and fake IT-support interactions. Meanwhile, the FBI’s Internet Crime Complaint Center warned about OAuth consent phishing, where victims can be tricked into granting malicious applications access to their accounts.
At the same time, NIST and CISA have placed increased attention on protecting identity and access tokens because stolen tokens can potentially allow attackers to access online resources without simply relying on a stolen password.
This makes identity security one of the most important parts of modern cybersecurity.
What Are AI-Powered Phishing Attacks?
AI-powered phishing attacks are phishing campaigns in which attackers use artificial intelligence or automated technologies to make social engineering more convincing, scalable, or efficient.
Traditional phishing often involves a fake email asking a person to click a link or enter a password.
Modern attacks can be more complicated.
An attacker might:
- Impersonate a company or IT department.
- Create a convincing login page.
- Send a personalized message.
- Use AI-generated text to make communication appear professional.
- Pretend to be a colleague or executive.
- Use a fake software download page.
- Trick users into approving an authentication request.
- Abuse legitimate authorization systems.
- Steal session or access tokens.
- Use compromised accounts to continue the attack.
The underlying objective is usually the same: gain unauthorized access to an account, device, application, organization, or valuable data.
The difference is that modern attacks can combine multiple techniques into a single attack chain.
Why Phishing Is Still a Major Cybersecurity Problem in 2026
Technology has improved, but human trust remains an important attack surface.
People routinely receive emails, messages, authentication notifications, software updates, collaboration requests, and support communications. Attackers can exploit this normal activity by creating a believable reason for someone to take an action.
Microsoft reported in September 2026 that threat actors were using AI-related brands and tools as bait for phishing, search-driven malware campaigns and malicious advertising. The company also described campaigns involving device-code authentication and social engineering.
This is important because users may recognize an obvious fake email, but a carefully constructed message that looks like a normal business request can be much harder to evaluate.
The attack does not necessarily need to break encryption or exploit an unknown vulnerability.
Instead, it can attempt to manipulate trust.
AI Is Making Social Engineering More Convincing
Artificial intelligence can help attackers generate content faster and potentially customize messages for different targets.
That does not mean every AI-generated message is sophisticated or successful. However, AI can reduce some of the effort traditionally required to create convincing text.
Microsoft’s security research has documented campaigns impersonating popular AI platforms and using AI-related themes to attract users.
The broader cybersecurity issue is therefore not simply “AI malware.”
AI can be useful to attackers at different stages of an operation, including:
- Researching potential targets.
- Creating convincing messages.
- Generating variations of phishing content.
- Automating repetitive tasks.
- Supporting social engineering.
- Creating fake technical instructions.
- Speeding up parts of an attack campaign.
Security defenders are also using AI, which creates an ongoing competition between attackers and defenders.
The practical lesson for users is simple: better-looking communication should not automatically be considered trustworthy.
The Rise of Token Theft
Passwords are not the only credentials attackers want.
Modern cloud applications frequently use tokens to represent an authenticated user or authorize access to resources.
A token can contain information that helps a service determine who the user is and what the user is allowed to access.
NIST and CISA finalized NIST IR 8587 in September 2026 specifically addressing protection of identity tokens, access tokens and assertions against forgery, theft and misuse. The guidance covers areas including token verification, key management, token lifecycle controls, single sign-on, federation and API access.
This reflects an important change in cybersecurity thinking.
Protecting an account is no longer only about protecting the password.
Organizations increasingly need to protect the entire identity and authorization system.
What Is OAuth Consent Phishing?
OAuth is commonly used to allow one application to request access to resources associated with another application.
For example, a user might authorize an application to access certain account information without giving that application the user’s password.
The system can be useful, but attackers can abuse the same authorization process.
The FBI’s IC3 issued a September 2026 public service announcement about malicious actors using OAuth consent phishing. According to the advisory, attackers were sending malicious links that encouraged targets to authorize applications controlled by the attackers.
This type of attack can be particularly deceptive because the user may see a legitimate-looking authorization screen.
The danger is not necessarily a fake password page.
Instead, the victim may be tricked into granting access to a malicious application.
How OAuth Phishing Can Work
A simplified attack chain can look like this:
1. Target receives a message
The attacker sends a convincing email or direct message.
2. Target clicks a link
The link leads to an authorization workflow.
3. Malicious application requests permissions
The user is encouraged to approve access.
4. User grants permission
The attacker may now receive authorized access to resources covered by the granted permissions.
5. Attacker uses the access
The compromised access can potentially be used to collect information or continue an attack.
The exact impact depends on the application, permissions granted, account configuration and security controls.
Passkeys and Phishing-Resistant Authentication
One important defensive development is the growing use of phishing-resistant authentication.
NIST’s current digital identity guidance explains that phishing resistance is designed to prevent authentication secrets or valid authentication outputs from being disclosed to an impostor verifier.
Passkeys based on modern public-key authentication technologies can provide phishing-resistant authentication.
Instead of typing a password into a website, the user’s device uses a cryptographic credential associated with the appropriate service.
This changes the security model.
A traditional password can potentially be entered into a fake website.
A phishing-resistant authenticator is designed so that authentication is cryptographically bound to the legitimate service.
NIST identifies WebAuthn/FIDO-based authentication as an example of phishing-resistant authentication.
Is MFA Still Useful?
Yes.
Multifactor authentication remains an important security control.
CISA recommends that organizations require MFA wherever possible and aim for phishing-resistant MFA. CISA also notes that different MFA methods provide different levels of protection.
However, users should understand that MFA does not automatically mean phishing-resistant MFA.
For example, an attacker may attempt to steal a one-time code or trick a user into approving an authentication request.
That is why organizations should consider stronger authentication methods where available.
A practical hierarchy is:
| Authentication Method | General Security Consideration |
|---|---|
| Password only | Weakest option |
| SMS code | Better than password-only, but has known limitations |
| Authenticator app | Stronger than password-only |
| Number matching | Helps reduce some approval-spam attacks |
| Security key | Strong phishing resistance |
| Passkey / WebAuthn | Strong phishing resistance when properly implemented |
The exact security of an implementation depends on the service, configuration and threat model.
Fake IT Support Is Another Growing Risk
Not every phishing attack starts with an email.
Microsoft reported a September 2026 campaign in which threat actors impersonated IT or helpdesk personnel through Microsoft Teams external collaboration.
According to Microsoft’s research, attackers attempted to convince users to grant interactive remote sessions. The attackers then used remote management tools and additional commands to establish malicious activity.
This illustrates an important cybersecurity principle:
A familiar communication platform does not automatically make a request trustworthy.
Attackers can abuse legitimate services because legitimate services already have trust and functionality built into them.
Users should therefore verify unexpected technical-support requests through an independent communication channel.
Fake Software Downloads Are Also Dangerous
Another major risk comes from counterfeit software installers.
Microsoft reported in September 2026 that its security researchers were tracking an active campaign involving fake software-download websites that impersonated trusted vendors and distributed malicious installers.
This is why users should be careful when downloading software from search results, advertisements or unfamiliar websites.
A website may look professional and still be malicious.
Safer Software Download Practices
Before downloading software:
- Prefer the developer’s official website.
- Check the exact domain name.
- Avoid suspicious advertisements offering unexpected downloads.
- Do not disable security protections just to install software.
- Keep your operating system updated.
- Use reputable endpoint security.
- Verify browser warnings instead of ignoring them.
- Avoid pirated or modified installers.
- Be especially careful with “urgent update” messages.
The Growing Importance of Identity Security
Modern organizations often use dozens or hundreds of cloud applications.
Employees may have accounts for:
- Cloud storage
- Collaboration platforms
- CRM systems
- Developer tools
- Financial applications
- HR systems
- AI services
- SaaS platforms
- Internal applications
Each identity can potentially become an entry point.
Palo Alto Networks’ 2026 Unit 42 Incident Response Report identified identity weaknesses as a significant factor across its investigations and highlighted the growing importance of identity-based attacks.
This means cybersecurity teams increasingly need visibility across identities, devices, applications, permissions and cloud environments rather than treating each system separately.
How Businesses Can Reduce Phishing Risk
There is no single security tool that eliminates phishing.
A layered approach is more practical.
1. Use Phishing-Resistant MFA
Where supported, organizations should consider passkeys or hardware security keys for sensitive accounts.
CISA specifically recommends moving toward phishing-resistant MFA.
2. Protect Administrator Accounts
Administrative accounts should receive stronger controls because compromise of a privileged identity can have much greater consequences.
Organizations should minimize unnecessary privileges and regularly review administrative access.
3. Monitor Authentication Activity
Security teams should look for unusual:
- Login locations
- Devices
- Authentication methods
- Application permissions
- Token usage
- Data downloads
- Account behavior
Unusual activity does not automatically mean an account is compromised, but it can justify additional investigation.
4. Review Application Permissions
Users and administrators should periodically review which third-party applications have access to their accounts.
Unexpected applications or excessive permissions should be investigated.
5. Train Employees
Security awareness training should go beyond simply telling employees to “spot phishing.”
Employees should understand:
- How fake support requests work.
- Why authentication prompts can be dangerous.
- How OAuth permissions work.
- Why urgent financial requests require verification.
- Why unexpected remote-access requests should be treated carefully.
- How to report suspicious activity.
6. Secure Cloud Tokens and Sessions
Organizations should implement appropriate token lifecycle, verification, revocation and monitoring controls.
NIST IR 8587 provides specific implementation guidance for protecting tokens and assertions in cloud and identity environments.
What Individuals Can Do Today
You do not need to be a cybersecurity expert to improve your security.
Start with these steps:
Enable MFA:
Turn on MFA for email, financial accounts, social media and important online services.
Use passkeys when available:
For compatible services, passkeys can provide phishing-resistant authentication.
Use a password manager:
Generate unique passwords rather than reusing the same password across multiple services.
Check URLs carefully:
Look at the actual domain before entering credentials.
Do not trust unexpected login requests:
If a message says your account needs urgent verification, open the service directly instead of following the message link.
Verify support requests:
If someone claiming to be IT support asks for remote access, independently verify the request.
Review connected applications:
Remove applications you no longer use and investigate unexpected permissions.
Keep software updated:
Security updates can address vulnerabilities that attackers may exploit.
Back up important data:
Maintain appropriate backups so that a compromised device does not automatically mean permanent data loss.
AI Security Is Becoming a Two-Sided Problem
AI is not only helping attackers.
Security teams are also using AI to analyze large volumes of security signals, identify suspicious activity and support incident response.
CrowdStrike’s 2026 research describes AI as both an attack accelerator and a new attack surface, while Google’s 2026 cybersecurity forecast similarly highlights an emerging competition between AI-enabled attacks and AI-assisted defense.
This creates an important distinction.
The future of cybersecurity is unlikely to be simply “AI versus humans.”
Instead, organizations will increasingly need to secure AI systems while also using AI responsibly to improve defensive operations.
That introduces new questions around:
- AI agent permissions
- AI-generated actions
- Data access
- Model security
- Prompt injection
- Shadow AI
- Agent identities
- Third-party AI applications
- Monitoring and governance
What Businesses Should Watch in the Rest of 2026
Several cybersecurity themes deserve continued attention.
Identity-Based Attacks
Attackers are increasingly interested in credentials, tokens, sessions and permissions because these can provide access without relying entirely on traditional malware.
AI-Assisted Social Engineering
AI can make impersonation and phishing content easier to produce and customize.
OAuth and Cloud Authorization Abuse
Organizations need to understand not only who can log in, but also which applications have permission to access data.
Software Supply Chain Attacks
Trusted software and dependencies can become attack paths when compromised.
AI Application Security
Organizations adopting AI need to consider the security of AI tools, data connections, agents and permissions.
Faster Attack Chains
Recent threat research suggests that attackers can move rapidly from initial access toward additional objectives, reducing the time available for defenders to respond.
The Future of Phishing Protection
Phishing is unlikely to disappear simply because passwords or email systems improve.
Instead, attacks may continue moving toward identity manipulation, authorization abuse, social engineering and trusted-platform exploitation.
The security industry is therefore moving toward a broader model in which authentication, authorization, device security, application security, monitoring and user behavior work together.
Phishing-resistant authentication is an important part of that strategy, but it is not a complete cybersecurity solution.
Organizations still need secure configurations, monitoring, software updates, access controls, backups and incident-response plans.
For individuals, the practical message is equally important: do not judge a request only by how professional it looks. Verify what the request is asking you to authorize, download, disclose or approve.
Frequently Asked Questions
What are AI-powered phishing attacks?
AI-powered phishing attacks use artificial intelligence or automation to help create, personalize or scale social engineering campaigns. They may involve fake messages, websites, impersonation, malicious downloads or authentication requests.
Can AI steal passwords?
AI itself does not automatically steal passwords. Attackers can use AI as part of broader campaigns designed to trick people into revealing passwords, clicking malicious links, downloading malware or granting access to malicious applications.
Are passkeys safer than passwords?
Passkeys can provide phishing-resistant authentication because they use cryptographic credentials rather than relying on users to type passwords into websites. NIST identifies WebAuthn-based authentication as an example of phishing-resistant authentication.
Is MFA enough to stop phishing?
MFA provides important additional protection, but not every MFA method is equally resistant to phishing. CISA recommends organizations aim for phishing-resistant MFA where possible.
What is OAuth consent phishing?
OAuth consent phishing is an attack in which a victim is tricked into authorizing a malicious application to access account resources. The FBI’s IC3 issued a September 2026 warning about this technique.
What is token theft?
Token theft involves obtaining authentication or authorization tokens that may allow access to online services or resources. NIST and CISA published IR 8587 in September 2026 with recommendations for protecting identity tokens, access tokens and assertions.
How can I protect myself from phishing?
Use MFA or passkeys, keep software updated, use unique passwords, verify unexpected requests independently, check website domains, avoid suspicious downloads and review third-party application permissions.
Why is identity security becoming more important?
Modern organizations rely heavily on cloud applications and digital identities. If an attacker compromises an identity, session, token or authorization mechanism, they may gain access to multiple resources without needing to compromise every system individually.
Final Thoughts
Cybersecurity in 2026 is increasingly about protecting digital trust and identity, not just installing antivirus software.
AI is helping attackers create more convincing campaigns, while stolen credentials, access tokens, OAuth permissions and compromised accounts can provide pathways into cloud environments.
Recent guidance from NIST and CISA emphasizes protecting tokens and authentication infrastructure, while Microsoft and the FBI have documented evolving phishing and identity-based techniques.
For individuals, the strongest practical steps include using MFA, choosing phishing-resistant authentication such as passkeys when available, verifying unexpected requests and downloading software only from trustworthy sources.
For businesses, identity security should be treated as a core part of the cybersecurity strategy. Strong authentication, least-privilege access, token protection, monitoring, employee awareness and rapid incident response can work together to reduce the impact of modern attacks.
The threat landscape will continue to evolve, but the basic principle remains the same: verify before you trust, authorize or disclose.