October is Cybersecurity Awareness Month. Implementing strong security practices can help protect you. The theme this month is “Don’t Make it Easy For Them”.
Cybersecurity News launched a campaign to help us build safer habits. I’m sharing their tips here today. Cybersecurity Awareness Month 2026 arrives as online attacks become easier to launch, harder to spot, and more focused on people.
After years of covering breaches, one pattern stands out to the Cybersecurity News team: most incidents still start with a person being tricked, not a system being cracked. That is why this year’s focus on habits matters so much. Cybersecurity does not require every person to become a security expert. It requires people to recognize risky moments, slow down, verify unusual requests, and make the safer choice.
Phishing is no longer limited to badly written emails. Attackers now use fake CAPTCHA pages, QR codes, Teams chats, AI-written messages, OAuth flows, voice calls, and real-looking sign-in pages.
Microsoft said in its Q1 2026 email threat report that it detected about 8.3 billion email-based phishing threats during the first quarter of 2026. By the end of the quarter, QR-code phishing had become its fastest-growing attack vector.
Cybersecurity awareness is not a once-a-year training task. It is an everyday defense layer.
Photo by Bermix Studio on Unsplash
10 Important Cybersecurity Habits to Stay Protected Every Day
1. Use a Unique Password for Every Account
Never reuse the same password across email, banking, social media, work accounts, and cloud services. If one site is breached, reused passwords can let attackers try the same login elsewhere.
2. Use a Password Manager
A trusted password manager can create and store long, random passwords. CISA includes password managers in its core online safety advice.3. Turn on MFA Wherever Possible
Enable multi-factor authentication for email, cloud, banking, developer, and admin accounts. Prefer passkeys, hardware keys, or authenticator apps where supported. Never approve an MFA request you did not start.
MFA remains important, but users should also understand that modern phishing kits can steal authenticated sessions after MFA has been completed. CyberSecurityNews recently documented attacks where victims completed MFA but attackers captured the Microsoft 365 session.
4. Keep Devices and Apps Updated
Install security updates for Windows, macOS, Linux, Android, iOS, browsers, VPNs, routers, and business software. Attackers often scan for systems that have not received known security fixes.
5. Stop Before Clicking
Urgency is a common social engineering tool. Messages saying “act now,” “account locked,” “payment failed,” or “CEO needs this today” should make you slow down and verify the request through another channel.6. Check the Real Destination
Before entering a password, inspect the site name. Attackers use look-alike domains, redirects, fake login pages, and trusted cloud services to hide the final destination.
Do not assume a page is safe simply because it contains Microsoft, Google, DocuSign, Cloudflare, or another known brand.
7. Treat QR Codes Like Links
Do not scan an unexpected QR code because it appears on a trusted-looking email, poster, invoice, or document.
Unit 42 researchers reported detecting about 75,000 QR codes each day, with around 15% of the pages containing QR codes leading to malicious links. CyberSecurityNews has also detailed how QR codes are being used for phishing and malicious mobile app delivery.
8. Never Run Commands From a Website
A web page should not normally tell you to press Win+R, open PowerShell, launch Terminal, or paste a command to “verify” yourself.
This is a key warning sign of ClickFix. Microsoft has documented ClickFix campaigns where fake CAPTCHA, download, and verification pages persuaded users to run attacker-provided commands.9. Back Up Important Data
Keep important files backed up using a method that ransomware cannot easily change. For business systems, test recovery regularly. A backup matters only if it can be restored.
10. Report Suspicious Activity Quickly
Report phishing emails, unusual MFA prompts, fake IT messages, and unexpected login alerts. Fast reporting helps security teams block domains, revoke sessions, reset accounts, and protect other users.
Photo by Markus Winkler on Unsplash
10 Social Engineering Attacks to Watch in 2026
1. AI-Written Phishing
Generative AI helps attackers create clean, personal phishing messages. Grammar mistakes are no longer a useful warning sign. Focus on the request, sender, link, and context.
CyberSecurityNews has detailed on how AI-generated phishing can steal authenticated browser sessions without traditional malware you may want to read.
2. Adversary-in-the-Middle Phishing
Adversary-in-the-middle, or AiTM, phishing places attacker infrastructure between the victim and the real login service.
The victim may enter the correct password and MFA code, but the attacker captures the authenticated session and can use it to access the account.3. OAuth Device-Code Phishing
This method sends victims to a real Microsoft sign-in page and asks them to enter an attacker-provided device code.
The website itself may be genuine, but approving the code can give the attacker access tokens. Proofpoint reported rapid growth in device-code phishing during 2026 as public tools and phishing services became easier to obtain.
4. ClickFix and Fake CAPTCHA Attacks
ClickFix pages tell users to run a command to complete a CAPTCHA, fix a browser issue, install an update, or open a file. In 2026, they targeted both Windows and macOS users.
The danger is that the victim performs the execution step for the attacker.
5. QR-Code Phishing
Also called quishing, these attacks place malicious links inside QR codes. The victim often moves from a protected desktop email environment to a mobile browser, where the final page may steal passwords, MFA codes, payment information, or other sensitive data.6. Fake IT Help-Desk Messages
Attackers impersonate support staff through Teams, email, chat, or phone calls. They may ask the victim to open Quick Assist, install remote-control software, share a code, reset a password, or give them control of a computer.
7. Voice Phishing and AI Voice Cloning
A caller may pretend to be a manager, bank worker, supplier, or family member. AI voice tools can make the call more believable.
Verify sensitive requests through a known phone number or another trusted channel rather than trusting the incoming call.
8. Business Email Compromise
Business email compromise, or BEC, involves attackers impersonating executives, suppliers, finance teams, or customers to request payments, invoice changes, gift cards, or sensitive files.
A compromised real mailbox makes these messages especially convincing because the attacker may have access to previous email conversations.9. Fake Job and Recruitment Attacks
Attackers use fake job offers, interview tasks, coding tests, and recruiter messages to steal login details, personal data, cryptocurrency, or developer credentials.
Some campaigns also deliver malware through project files or software packages.
10. Consent and App-Permission Scams
Instead of stealing a password, attackers may ask a user to approve a cloud app, OAuth connection, browser extension, or account permission.
One careless approval can provide long-term access to email, files, contacts, customer records, or other business data.
Check-in
I encourage you to check-in with yourself and those in your household about your technology. Security in all things is important, and cybersecurity is extremely important. Schedule a cybersecurity review regularly.
I so appreciated the participants in The Ready Room in September. Making time while we’re healthy to work for an hour on tasks with support was invaluable.
I’ve set it up for twice a month through the end of the year, if you’d like to join me. There is a per-session charge of $25 for the hour. Learn more HERE
If you ever want to discuss your situation and/or have questions, please feel free to Email me. If you’d like to learn more about my work, check out my website @ The Living Planner.
I’ve written my book for people who would like to consider planning for now and after a loss. The 2026 edition of Living Planner What to Prepare Now While You Are Living © can be purchased HERE.
Send along any hot topics you have. It’s great when I hear from you!
Quote of the week: “Enjoy the little things, for one day you may look back and realize they were the big things.” -Robert Brault
Little things are big things! Lynn
#Can’tPredictCanPrepare #CareForPeopleCareForBusiness