What's Happening Right Now
Phishing has evolved from clumsy spam emails into highly engineered, multi-channel attacks that bypass traditional security controls. In 2025 and early 2026, threat actors are deploying four converging techniques that are causing record-breaking business compromise rates. First, Adversary-in-the-Middle (AiTM) phishing kits intercept legitimate login sessions, capturing session cookies that allow attackers to bypass multi-factor authentication (MFA) entirely. Second, QR code phishing (quishing) is replacing traditional URLs, exploiting employee trust in mobile scanning and instant messaging apps. Third, AI-cloned voice phishing (vishing) is enabling social engineers to impersonate executives, HR personnel, or vendors in real time. Finally, spear-phishing campaigns are mining LinkedIn and professional networks to craft hyper-personalized lures that bypass human skepticism. The FBI’s Internet Crime Complaint Center (IC3) reported a 42% year-over-year increase in business email compromise (BEC) losses in 2025, with phishing serving as the initial access vector in over 78% of cases. These attacks are no longer guesswork; they are industrialized operations leveraging publicly available threat intelligence.
How This Attack Works
Modern phishing follows a precise, automated workflow. Attackers begin by harvesting publicly available data—company directories, job postings, and professional profiles—to map organizational hierarchies. They then deploy AiTM phishing pages that mirror your actual SaaS or email login portals. When an employee enters their credentials and MFA code, the phishing infrastructure doesn’t just log the password. It relays the request to the real service, captures the authentication session token, and forwards the MFA response to the legitimate server. Within seconds, the attacker has a valid, authenticated session that skips MFA protections entirely. Quishing follows a similar path but leverages mobile convenience: a QR code redirects a smartphone directly to a token-stealing login page or messaging app authentication screen, which many users scan without verifying the destination. Vishing attacks combine AI voice synthesis with real-time social engineering, often initiated by a phishing email that creates urgency, followed by a “follow-up” phone call from a cloned voice of a manager or vendor. The goal is always the same: tricking you into granting access or authorizing a transfer before verification can occur.
Real-World Examples
In Q4 2025, a mid-sized logistics firm lost $1.2 million after employees scanned a QR code in a spoofed invoice email. The code routed them to a session-stealing AiTM portal disguised as their freight management system. Attackers captured admin tokens and rerouted vendor payments. Separately, a professional services company with 45 employees fell victim to AI vishing. A phishing email claimed an urgent compliance audit was underway, directing staff to a “verification line.” Within hours, attackers used cloned voices of the CFO to authorize two wire transfers totaling $380,000. Both incidents were documented in CISA’s 2025 Joint Cybersecurity Advisory on AiTM and QR-based compromises. The attackers in both cases used commercially available phishing kits and open-source AI voice models, demonstrating how accessible these tools have become. The FBI’s 2025 BEC report noted that businesses with fewer than 100 employees were targeted at disproportionately high rates, often because they lack dedicated security teams and rely on standardized employee training that hasn’t updated for these techniques.
Who Is Most at Risk
SMEs in financial services, healthcare, professional services, and logistics are primary targets because they handle sensitive client data, process high-volume invoices, and maintain critical third-party integrations. Businesses with 10–100 employees are especially vulnerable. They typically operate with lean IT staff, use consumer-grade email security, and rely on legacy MFA methods like SMS or push notifications. Attackers prioritize these environments because the return on investment is high, and the attack surface is often unmonitored. According to MITRE ATT&CK, initial access via phishing (T1566.001) remains the most frequently exploited technique, but the new AiTM and quishing variants have shifted from reconnaissance to immediate credential compromise. The FBI IC3 consistently flags that organizations without email authentication protocols (DMARC, DKIM, SPF) and phishing-resistant MFA suffer 3x higher incident resolution times.
Warning Signs to Watch For
Employee vigilance remains your first line of defense. Train teams to recognize these specific indicators:
- QR codes embedded in unexpected invoices, shipping updates, or vendor messages. Legitimate businesses rarely use QR codes for financial approvals.
- Login pages that request MFA but never redirect to a secondary verification step. AiTM pages capture tokens silently.
- Urgent voice calls following an email, especially when the caller avoids video verification or claims “system integration issues” that prevent standard communication.
- LinkedIn messages that reference internal projects, recent job postings, or colleague names without a verifiable corporate email signature.
- MFA push notifications or SMS codes arriving for logins you didn’t initiate. Attackers using AiTM trigger these in real time.
- Requests to scan a code, click a link, or verify credentials through an unbranded domain, even if the sender address appears legitimate.
How to Protect Your Business
Defense requires a layered strategy aligned with NIST CSF 2.0 and CIS Controls v8. Start with foundational email hygiene: enforce DMARC with a p=reject policy, verify DKIM and SPF configurations daily, and monitor for domain spoofing. Replace SMS and TOTP MFA with phishing-resistant authentication. FIDO2/WebAuthn security keys and device-bound passkeys do not accept stolen session tokens. Implement a zero-trust access model that requires continuous verification, especially for financial and administrative systems. Deploy an AI-powered email security gateway that detects AiTM and quishing patterns, not just malicious attachments. Establish a strict vendor verification procedure: all payment changes or wire requests must be confirmed via a secondary channel using pre-verified phone numbers, not numbers provided in the original message. Finally, run quarterly phishing simulations that test AiTM, QR, and vishing scenarios, with immediate remedial training for failures. The FBI and CISA recommend treating every unexpected verification request as a potential compromise until independently confirmed.
Quick Action Checklist
- [ ] Audit and enforce DMARC p=reject across all company domains
- [ ] Replace SMS/TOTP MFA with FIDO2 security keys or passkeys for all admin and financial accounts
- [ ] Block or restrict QR code scanning in email and messaging platforms
- [ ] Publish a verified vendor contact directory and require callback verification for all payment changes
- [ ] Deploy AI-enhanced email security with AiTM and credential harvesting detection
- [ ] Schedule quarterly phishing simulations covering QR, AiTM, and voice cloning scenarios
- [ ] Train staff to reject real-time MFA prompts they didn’t initiate and report them immediately
- [ ] Review and update incident response playbooks to include BEC and session-token compromise procedures
Start Here This Week Begin by disabling SMS-based MFA for all administrative and payment systems. Next, publish your official vendor contact list to every department and mandate callback verification for financial requests. Run a single targeted phishing simulation focused on QR codes and fake login pages, then debrief results with your team. These three steps will immediately neutralize the most common 2025–2026 attack vectors. If you need assistance implementing phishing-resistant MFA, configuring DMARC, or designing SME-focused security training, contact IJE Software’s security advisory team.