For years, social engineering has been one of the most effective techniques in a threat actor's arsenal. Rather than exploiting software vulnerabilities, attackers exploit something far more accessible: human trust. While traditional phishing campaigns remain prevalent, the social engineering landscape of 2026 looks dramatically different from that of just a few years ago.
Advances in artificial intelligence and the widespread adoption of cloud identity platforms have created new opportunities for attackers to manipulate users into performing actions on their behalf. Modern social engineering campaigns are no longer limited to deceptive emails and fake login pages. Threat actors are now leveraging AI tools to generate fake webpages and automated backend scripts for phishing kits along with sophisticated vishing (voice phishing) operations to manipulate users.
Techniques such as consent phishing, device code abuse, passkey enrolment hijacking, and elaborate helpdesk impersonation schemes demonstrate how attackers are adapting alongside defensive improvements. As organisations strengthen their technical controls, threat actors are increasingly focused on exploiting the people who use them.
This blog explores the evolution of social engineering tactics observed in 2026, from how the threat landscape is changing, to what security teams should be doing to stay ahead.
2025-2026 has seen a sharp rise in vishing, or voice-based phishing, attacks, with recent campaigns demonstrating increasing levels of sophistication, personalisation and operational coordination.
In one example, Okta intelligence reported on a newly observed campaign involving Entra passkey enrolment. The example attack flow can be found below:
Essentially, the initial access point is when the victim enters credentials and completes MFA challenges, and everything after that is about establishing persistence through authenticator enrolment.
This campaign demonstrates a significant evolution in social engineering tradecraft. Rather than stealing credentials for immediate use, threat actors are manipulating victims into helping them establish long-term access through legitimate authentication mechanisms. The focus has shifted from credential theft towards identity lifecycle abuse, where the enrolment of authenticators, passkeys, devices, or recovery methods becomes the primary objective.
Leader’s takeaway:
The significance of this campaign is not simply that attackers are stealing credentials. They are manipulating legitimate enrolment processes to create persistent access that may appear trusted within the identity environment.
ClickFix has been one of the most well-documented social engineering tactics of the last year, driven by its increasing popularity among threat actors. The technique tricks users into running malicious commands under the guise of fixing an issue and is frequently used to deliver infostealer malware designed to steal credentials, session cookies and other sensitive data.
Since the start of 2026, CSA Cyber has tracked several variations of these campaigns and observed numerous defence evasion techniques being adopted in the delivery of malicious commands. However, recent developments in both the "InstallFix" and "ConsentFix" variants have been particularly noteworthy, as they move away from traditional phishing emails as the primary delivery method.
InstallFix was first documented in early March 2026, and was dubbed “Fake Claud Installer threat”. As the name suggests, threat actors are now weaponising legitimate AI platforms to deliver state-linked espionage and infostealer malware.
In this example, fake Claude installer pages are distributed exclusively through a method known as paid search advertising. Given the 'malvertising URLs' are designed to mimic Google Ads, they have legitimate parameters embedded in the URL, allowing them to seemingly evade detection.
When the victim clicks on one of these malvertising URLs, they are taken to a page that closely resembles the legitimate Claude website. In reality, the site is fraudulent, with subtle functionality issues that may be difficult for an average user to identify; like navigational features that do not work.
Fraudulent landing page - TrendMicro
The fake website with a malicious command for Windows systems - TrendMicro
What looks like a legitimate Claude installer is actually a multi-stage payload that adopts advanced obfuscation (techniques designed to disguise malicious code) and other defence evasion techniques.
What makes this technique particularly effective is that it exploits existing user behaviour. Victims are not being lured through unusual channels; they are searching for legitimate AI tools and being intercepted through convincing paid search placements and realistic installation pages. The abuse of trust here makes this difficult to detect if you are not paying close attention to the slight flaws in website functionality.
ConsentFix, (also known as AuthCodeFix, is a technique that abuses trusted authentication workflows rather than stealing passwords directly. Emerging publicly in late 2025, it has since evolved into a highly effective method of abusing OAuth authentication workflows to obtain access tokens without harvesting user credentials.
In this technique, the adversary abuses Microsoft's OAuth authorisation code flow by leveraging trusted first-party applications such as Azure CLI, Visual Studio, Teams, and Azure PowerShell. The victim is first directed to a phishing website and then redirected to Microsoft's legitimate authentication portal, where they are prompted to sign in and complete any required MFA challenges. Once authentication succeeds, Microsoft generates an OAuth authorisation code and redirects the browser to a localhost URL that would normally be handled by the legitimate application that initiated the request.
Because no application is actually listening on the localhost address, the victim is presented with an error page. The phishing site has already prepared the victim for this outcome and instructs them to copy the URL from their browser and paste it back into the website. Unknowingly, the victim is providing the embedded authorisation code to the attacker, who can then exchange it for Microsoft-issued access tokens. These tokens grant the attacker access to the victim's Microsoft 365 resources without ever requiring their password.
This technique is effective as these applications are implicitly trusted by Entra ID and pre-consented by default. As a result, attackers can abuse the authorisation process without triggering the same user warning prompts commonly associated with third-party applications. The example attack flow can be seen in more detail below:
ConsentFix attack flow - PushSecurity
Unlike device code phishing, where the victim authenticates the attacker's session directly, ConsentFix abuses the OAuth authorisation process itself by convincing the victim to manually provide a valid authorisation code. In both cases, the result is the same, the attacker obtains legitimate Microsoft-issued tokens without ever needing to steal the user's password.
CSA Cyber has observed a gradual increase in the use of this technique over the course of 2026 and currently maintains targeted threat hunting coverage to detect associated activity.
Leader’s takeaway:
ConsentFix demonstrates why identity security cannot rely solely on password protection. Attackers are increasingly abusing legitimate Microsoft authentication flows, making monitoring, token visibility and behavioural detection critical.
One of the most notable social engineering campaigns observed in 2026 was Microsoft's disclosure of a large-scale AI-enabled device code phishing operation. While device code phishing has existed for several years, this campaign demonstrated a significant increase in sophistication using AI-generated phishing lures, automated infrastructure, and dynamic code generation.
In this campaign, dynamic code generation ensures the device code's 15-minute countdown only begins the moment the victim clicks the phishing link and lands on the malicious page. This increases the likelihood that the code remains valid at the point the user is prompted to enter it, increasing success rate.
Unlike traditional phishing attacks, the victim never enters credentials into an attacker-controlled website. Instead, the victim authenticates directly with Microsoft and unknowingly approves the attacker's session.
The attack flow typically follows these stages:
What makes this attack particularly effective is that no passwords are stolen and the victim interacts exclusively with legitimate Microsoft authentication pages. As a result, many traditional anti-phishing controls are less effective, as the compromise occurs through abuse of a trusted authentication process rather than credential harvesting. This is further emphasised with domain usage; they were either impersonating legitimate services (i.e. Azure / O365) or having longer, irregular domains to avoid the full domain being blocked straight away such as a7b2-c9d4.office-verify[.]net.
CSA Cyber has observed the use of malicious inbox rules and Microsoft Graph reconnaissance as post-compromise techniques used by threat actors to maintain access and gather intelligence within victim environments. These behaviours continue to be monitored through our detection and threat hunting capabilities.
Leader’s takeaway:
Device code phishing is difficult to counter with traditional anti-phishing controls because the victim interacts with legitimate Microsoft authentication pages. Detection therefore depends on monitoring authentication behaviour, device registration activity and post-compromise actions.
Given the wide range of initial access techniques discussed throughout this blog, post-compromise hunting often provides a more reliable detection strategy than attempting to identify every individual phishing variant. For security leaders, this means detection coverage should focus not only on the initial lure, but also on the behaviours that follow successful compromise.
Regardless of the initial access vector, attackers typically perform a common set of reconnaissance, persistence and collection activities once access has been established:
Leader’s takeaway:The common thread across these techniques is identity abuse. For leaders, the priority is not just preventing phishing emails from landing, but improving visibility across authentication, enrolment, token use and post-compromise behaviour.
The evolution of social engineering in 2026 demonstrates that attackers are increasingly targeting identity rather than infrastructure. AI-generated content, trusted authentication workflows, and legitimate cloud services are enabling adversaries to bypass many traditional security controls. Organisations must therefore shift their focus beyond credential theft to monitoring identity lifecycle events and strengthening user awareness around modern authentication abuse.
This shift is already reflected in real-world incident response. At the start of the year, Palo Alto Networks’ Unit 42 incident response team reported that identity weaknesses played a material role in almost 90% of the investigations they conducted1. As social engineering techniques continue to evolve and target identity rather than credentials alone, organisations should expect this trend to persist throughout the remainder of 2026 and beyond.
While many of the techniques discussed in this article focus on gaining initial access, the ultimate objective is often the same: exploiting trust to achieve a financial, operational or strategic outcome.
Business Email Compromise (BEC) remains one of the most common examples of this principle in practice, combining social engineering, identity abuse and impersonation techniques to manipulate legitimate business processes. CSA Cyber's latest threat report explores how BEC attacks continue to evolve, the tactics being used by threat actors and the steps organisations can take to strengthen their defences.
Access the full threat report here.
References
1 Palo Alto Networks, 2026. Global Incident Response Report 2026.