RJ PRO Tech Group - Jackson - Ca

MFA fatigue is one of the most common attacks on small businesses today, and most owners don't know it by name.

The attacker already has the password (bought from a leak or stolen from another site). They log in. The MFA push hits your employee's phone. They tap "Deny." The attacker tries again 10 seconds later. Then again at 2am. Then during lunch. Eventually someone taps "Approve" just to make it stop. The attacker is in.

Uber got hit this way in 2022. Cisco too. It still works on small businesses every week because passwords keep leaking and the push prompt looks identical to a real login.

Three things close the gap, and none of them are expensive. Switch your team from "tap to approve" to number matching, which both Microsoft Authenticator and Duo support out of the box and takes about 10 minutes to enable in your tenant. Then turn on geo-blocking or impossible-travel rules in your identity platform so logins from countries you don't operate in get blocked before the push ever fires. Last, give your team one rule: if you get an MFA prompt you didn't ask for, deny it AND report it. The report is what catches the attacker mid-attempt.

The attacker doesn't need a fancy hack. They just need someone tired enough to tap "Approve."

Microsoft's phishing report for the first quarter of 2026 shows how much phishing has changed in the past year.

In three months:

-8.3 billion phishing threats detected
-QR code phishing up 146% from last year, with a 336% spike in March 2026 alone for QR codes hidden inside emails
-Phishing pages hiding behind CAPTCHA puzzles jumped 125%. CAPTCHAs make the pages look real AND stop security scanners from checking them.
-10.7 million business email compromise attempts in one quarter

Hackers moved from text to images, codes, and CAPTCHAs because text-based filters can't read them. Even an expensive email gateway misses most of this.

If your phishing training still shows examples of misspelled emails from "Nigerian princes," you're teaching your team history, not security.

What to do this month:

-Update your phishing training. If it doesn't include QR code emails and fake CAPTCHA login pages, you're testing 2023 skills against 2026 attacks.
-Tell your team one rule: any QR code that arrives in an email is suspicious. No exceptions.
-Ask your email security vendor what they catch for image and QR phishing. Get the answer in writing.

Train your team for the phishing they'll actually see this year.

QR code phishing surges 146% as Microsoft detects and analyzes 8.3 billion phishing threats in Q1 2026 – attackers are changing tactics to bypass security Microsoft noted a marked increase in QR-code attacks and CAPTCHA delivery methods.