Security Digest: Quarterly Insights Q3 2026

How a quishing attack unfolds · 4 steps

The moment you scan, the attack leaves your protected work PC and carries on from your phone.

REAL WORLD CASE STUDY | FBI Flash Alert: North Korean Kimsuky Quishing, January 2026

In January 2026, the FBI warned that the North Korean state-sponsored group Kimsuky was sending spear phishing emails with embedded QR codes to think tanks, universities, and government agencies. The emails told recipients the code would open a questionnaire, an event registration page, or a secure file share. It was a nation-state group choosing QR codes precisely because they slip past email defenses and land on less-protected phones.

Why This Is Hard To Detect:

A QR code hides its destination until the moment you scan it, so neither you nor your email filter can inspect the link in advance. There is also very little text to spot potential indicators of fraud (such as a misspelled URL). An example can be seen below:

What You Can Do

• Do not scan QR codes in unexpected emails, especially ones asking you to log in, re-verify, or sign something. Legitimate Microsoft and IT requests will never ask you to scan a code to keep your account active.
• Go to the site directly instead. If the email says your account or document needs attention, open your browser and type the address yourself.
• Preview before you open. Most phone cameras show the web address before opening it. If it does not match the company it claims to be, or looks like a random string, do not open it.
• Never enter your work password on a page you reached by scanning a code.
• Check physical QR codes for stickers placed on top of the original, especially on parking meters and payment signs. When in doubt, use the official app or website instead.
• If you already scanned and entered your password, report it to IT immediately and change your password from a different device.

The bottom line: A QR code is just a link you cannot read. Treat it with the same suspicion as any unexpected link, and never let a code in an email send you to a login page.

Microsoft Retires SMS and Voice MFA

Why Text Message Codes Are No Longer Enough

What Is Changing?

Microsoft is retiring text message (SMS) and phone call (voice) codes as a way to prove it is you when signing in to Microsoft 365. Microsoft now states plainly that SMS and voice are no longer considered secure sign-in methods (Microsoft Learn).

The replacement is a passkey, most commonly stored in the Microsoft Authenticator app on your phone. Authenticator app approvals, hardware security keys, and Windows Hello are not affected.

Why SMS Codes Are No Longer Secure:

1. SIM swapping. An attacker convinces, or bribes, a mobile carrier employee to move your phone number to a SIM card they control. Every text code sent to "you" now goes to them.
2. Phishing relay. A fake login page asks for your code, and you type it in. The attacker passes it to the real site within seconds. A six-digit code cannot tell a real website from a fake one.
3. Network interception. Weaknesses in the decades-old systems phone carriers use to route messages can allow texts to be redirected.
4. Social engineering. A caller posing as IT or your bank asks you to "read back the code we just sent." That code is the key to your account.

The attacker never touches your phone; they only need your carrier to move your number.

A passkey fixes these problems. It is tied to your specific device and only works on the real Microsoft website, so there is no code to steal, forward, or read aloud.

REAL WORLD CASE STUDY | AT&T Store Worker Sentenced for SIM Swaps, September 2026

In September 2026, a former AT&T retail employee in Portland, Oregon was sentenced to 16 months in federal prison. Accomplices walked into his store pretending to be customers, and he moved their phone numbers onto cheap flip phones. The gang then received the victims' text message codes and password reset messages, and used them to break into bank accounts. Intended losses totaled nearly $600,000. The victims did nothing wrong. Their text codes simply went to someone else's phone.

Why This Is Hard To Detect:

When a SIM swap happens, the only sign is that your phone suddenly loses service, which most people assume is a network glitch. Meanwhile, the attacker is receiving your MFA codes. When an attack takes place and you type a code into a fake page, everything looks normal to the victim.

What You Can Do

• Set up a passkey in the Microsoft Authenticator app when prompted. Do not keep snoozing the reminder. After February 1, 2027, you will not be able to sign in without it.
• Install Microsoft Authenticator only from the official Apple App Store or Google Play Store. Contact IT if you need help, or if you do not have a company or personal smartphone you can use.
• Never read a sign-in code or approval number to anyone who calls you, including someone claiming to be IT. IT will never ask for it.
• If your phone suddenly shows "No Service" or "SOS only" for no clear reason, contact your carrier and IT right away. It may be a SIM swap.
• Add a PIN or port-out lock to your personal mobile carrier account. Most major carriers offer this free.
• Move your personal accounts too. Switch your bank, email, and social accounts from text codes to an authenticator app or passkey wherever offered.

The bottom line: A text message code proves someone has your phone number, not that they are you. Passkeys are the new standard for signing in, and setting yours up now avoids being locked out in February.

Help Fraud

The "Bank" or "IT Department" That Calls You First

What Is Help Fraud?

Help fraud flips the usual scam around. Instead of tricking you into doing something risky, the attacker poses as the person protecting you: your IT department, Microsoft support, or your bank's fraud team. They call to say they are "investigating suspicious activity" on your account or computer, and they need remote access to fix it.

What makes it convincing is that there often is a real problem. Attackers create one first, such as flooding your inbox with hundreds of spam emails, or they point to a real data breach in the news. Then they call offering to solve it.

How It Works:

1. The attacker creates or borrows a real threat. Your inbox suddenly fills with dozens of junk sign-up emails. Or you receive a real-looking fraud alert. Or there is a genuine breach in the headlines.
2. The call arrives. A phone call, or increasingly a Microsoft Teams chat or call from an account named "IT Support" or "Help Desk." Caller ID may even show your real IT or bank phone number, which is easy to fake.
3. They "investigate." The caller knows your name, your manager, maybe the spam you just received. They sound calm, professional, and helpful. They confirm the threat is real and urgent.
4. They ask for remote access. You are asked to open Quick Assist (built into Windows), AnyDesk, TeamViewer, or a similar tool, and read them a code or click "Allow."
5. They take control. While "fixing" the problem, the attacker installs malware, steals passwords, or opens your banking site. With banks, they may walk you through moving money to a "safe account" that they control.
6. They stay. Hidden software lets them return later, often to deploy ransomware across the whole company.

How a help fraud attack unfolds · 4 steps

Everything before the remote session is just talk; granting access is the point of no return.

REAL WORLD CASE STUDY | Chaos Ransomware via Fake IT Support in Microsoft Teams, 2026

Between February and June 2026, security firm Sophos tracked a criminal group contacting employees at dozens of U.S. and Canadian companies through Microsoft Teams, posing as help desk staff. Victims in manufacturing, construction, engineering, energy, and services were talked into opening Quick Assist or a similar remote tool. Once connected, the attackers installed their own software, stole data, and in at least three cases deployed ransomware. In one case, only 17 hours passed between the "help desk" call and the ransomware attack.

Why This Is Hard To Detect:

The tools used are legitimate. Quick Assist is a real Microsoft app, and your security software sees you choosing to grant access. The caller is not asking you to click a strange link. They are solving a problem you can see with your own eyes, which is exactly what real IT would do.

Fake IT Support chat in Microsoft Teams · illustrative example

Any one of these flags is reason enough to end the chat and contact IT through a channel you already know.

What You Can Do

• Never grant remote access to someone who contacted you first. If you did not open a ticket or call IT yourself, do not open Quick Assist, AnyDesk, or TeamViewer for them.
• Hang up and call back. Use the IT number you already know, or the number on the back of your bank card. Never use a number or link the caller gives you.
• Do not trust caller ID or a Teams display name. "IT Support" in Teams can be any outside account. Check whether it shows as External.
• Your bank will never ask you to move money to a "safe account" or to install software so they can see your screen.
• Never read out a sign-in code, MFA number, or password over the phone, no matter who is asking.
• A sudden flood of spam emails is itself a warning sign. Report it to IT and expect that a fake "help" call may follow.
• If you already let someone in, disconnect from the internet and call IT immediately. Minutes matter.

The bottom line: Real help rarely calls you first. When someone reaches out to fix a problem, end the conversation and contact IT or your bank yourself using a number you already trust.

AI Is Finding Vulnerabilities Faster Than We Can Patch Them

Record Patch Days and a Very Busy Year for Zero-Days

What Is Happening?

AI tools can now read software code and find security flaws far faster than human researchers. Software makers are using this to find and fix bugs in their own products. Attackers are using the same tools to find bugs to exploit.

The result is a flood of security updates. Before this year, Microsoft's largest monthly update fixed 175 flaws, in October 2025 (Dark Reading). Here is what 2026 looked like:

Counts from BleepingComputer and Dark Reading.

How It Works:

1. AI scans code at massive scale. A task that took a skilled researcher weeks, reading through code looking for a mistake, now takes an AI model minutes. It can check thousands of programs at once.
2. Software makers race to fix what AI finds. Microsoft, Google, Oracle, and others now ship far larger updates every month.
3. Attackers use AI on the patches themselves. When an update is released, attackers compare the old and new code to see exactly what was fixed, then build an attack for anyone who has not installed it yet.
4. Some flaws are exploited before a fix exists. These are "zero-days," and this year has been especially busy for them across Windows, Chrome, Citrix, and other widely used products.

REAL WORLD CASE STUDY | Microsoft Warns Customers to Expect More Updates from AI-Discovered Flaws, July 2026

In July 2026, Microsoft announced it was using an AI-powered system to scan critical parts of Windows for vulnerabilities, with multiple AI models checking each finding. Microsoft told customers directly to expect a higher volume of security updates every month as a result. Within weeks, its monthly updates jumped from around 200 fixes to 570, then to 966 in September. Other companies report the same trend: Anthropic says its Claude Mythos Preview model has uncovered more than 10,000 high- or critical-severity flaws in widely used software.

Why This Matters To You:

More fixes are good news, but only once they are installed. Every unpatched computer, phone, or browser is exactly the target attackers are looking for, and they can now find it faster than ever. Updates that sit waiting for "later" are the gap attackers walk through.

Each of these finishes installing only when you restart or relaunch it.

What You Can Do

• Restart when prompted. Most updates only take effect after a restart. Do not postpone update restarts for days at a time.
• Leave your computer on and connected when IT schedules updates, and do not cancel or delay installs that IT has pushed.
• Keep your phone updated too. Turn on automatic updates for iOS or Android and for your apps.
• Close and reopen your browser regularly. Chrome and Edge install security fixes when they relaunch. If you see an "Update" button in the corner, click it.
• Expect more frequent and larger updates. This is the new normal, not a sign that something is wrong with your computer.
• Report devices that say they cannot update, or that have not restarted in a long time, to IT.

The bottom line: AI has made finding security flaws fast and cheap, for both defenders and attackers. The patch only protects you once it is installed, so treat update prompts as urgent, not optional.

Browser Extensions

The Software You Installed That Can See Everything

Why Extensions Are a Risk

Browser extensions are add-ons for Chrome and Edge that add specific in-browser functionality. This can include blocking ads, checking grammar, saving coupons, taking screenshots, or summarizing pages with AI. They are convenient, and most are harmless. But to do their job, many ask for permission to "read and change all your data on all websites."

That means an extension can see every page you open, including Microsoft 365, your bank, and HR systems. It can read what you type, capture what is on screen, and copy the login cookies that keep you signed in. The extension can also update itself silently in the background, so a trustworthy extension can turn malicious overnight.

How It Works:

1. You install a useful-looking extension, often from the official Chrome Web Store, with good reviews and a "Featured" badge.
2. You click "Add extension" and accept broad permissions without reading them, because everyone does.
3. The extension behaves normally, sometimes for months, to build trust and pass store reviews.
4. A malicious update arrives. The developer sells it to criminals, gets hacked, or simply switches on hidden code. The update installs automatically.
5. It quietly collects everything: browsing history, screenshots, form entries, AI chatbot conversations, and session cookies that let attackers log in as you, even with MFA.

How long an extension has been installed says nothing about whether it is safe today.

REAL WORLD CASE STUDY | "Poper Blocker" Ad Blocker Flagged as Spyware, September 2026

In September 2026, researchers reported that Poper Blocker, a popular ad-blocking extension with over two million users, a "Featured" badge, and "Established Publisher" status in the Chrome Web Store, was secretly collecting users' browsing history, screenshots, and AI chatbot conversations (Dark Reading). It used hidden code designed to avoid security tools. Earlier in the year, researchers at Socket found 108 malicious extensions in the Chrome Web Store run by a single operator, some opening backdoors every time the browser started. The official store is not a guarantee of safety.

Why This Is Hard To Detect:

A malicious extension does not look or act like a virus. It runs inside your trusted browser, using permissions you granted, and sends data out with your normal web traffic. There is no pop-up or slowdown. Most people forget which extensions they even have installed.

What You Can Do

• Do not install browser extensions on work devices without IT approval. "Free," "popular," and "Featured" do not mean safe.
• Review what you have installed right now. In Chrome, go to chrome://extensions. In Edge, go to edge://extensions. Remove anything you do not recognize or have not used recently.
• Be wary of any extension asking to "read and change all your data on all websites," especially ad blockers, coupon tools, PDF converters, VPNs, and AI helpers.
• Keep work and personal browsing separate. Do not add personal extensions to the browser profile you use for work.
• Be especially careful with AI extensions that offer to summarize or rewrite pages. They need to read everything on screen, including confidential work.
• If an extension suddenly changes behavior, adds ads, redirects searches, or asks for new permissions, remove it and tell IT.

The bottom line: Every extension is software with a front-row seat to everything you do online. Fewer is safer, and on work devices, only install what IT has approved.

Questions, Concerns, or Suspicious Activity?

If something feels off, stop and report it. Questions, concerns, or suspicious activity?

Contact the ACT Security Task Force

soc@actweb.com

As always, Advanced is proud to be here for all your security needs.

— The ACT Security Task Force

Sources

• ESET / WeLiveSecurity: How QR-code phishing can slip past corporate security measures
• Forbes: QR Code Governance: How Businesses Can Manage The Risks Of Quishing
• FBI Flash Alert: Kimsuky QR code spear phishing
• Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
• The Register: AT&T store worker gets 16 months inside for SIM-swap side hustle
• Cybersecurity Dive: Hackers abuse Microsoft Teams in ransomware campaign through fake IT support
• BleepingComputer: Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
• BleepingComputer: Microsoft expects more Windows security updates from AI-discovered flaws
• Dark Reading: Blame AI: Patch Tuesday Hits Record 206 CVEs
• ISMG: AI Doesn't Wait for Patch Tuesday
• SC Media: Malicious ad-blocking extensions exploit Chrome Web Store trust
• Cybernews: Attacker sneaks 108 malicious Chrome extensions into official store
• https://consumer.ftc.gov/consumer-alerts/2024/03/new-tech-support-scammers-want-your-life-savings
• https://www.nospamproxy.de/en/quishing-phishing-with-qr-codes/
• https://www.reversinglabs.com/blog/qr-code-phishing-evolves