buildOne report1 publisher MFA-relaying proxy kits make up 44.6% of phishing techniques in Microsoft's 2026 report
Microsoft's 2026 Digital Defense Report puts MFA-relaying proxy kits at 44.6% of phishing techniques, as phishing rose to 23% of its incident cases. SMS codes and push approvals pass straight through those proxies, so protecting company email now means passkeys or FIDO2 keys, starting with admins and finance staff.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence55
buildConfirmed3 publishers The Unicode tag block was a jailbreak trick before it was a spam trick. Microsoft's signature for it went from 21,000 hits in a day to more than 2.3 million three days later, and NFC normalization does not strip it.
Perspective Coverage
3 publishers
- Builder
- Builder 50%
- Operator
- Operator 43%
- Investor
- Investor 7%
Reality
- Evidence68
- Adoption50
- Hype gap+30
- Incentives60
- Confidence65
Microsoft's hunting signature for hidden AI instructions kept firing on ordinary bulk mail instead, where the invisible characters were doing nothing more ambitious than breaking a keyword, and failing at that.
Reality
- Evidence60
- Adoption30
- Hype gap+25
- Incentives40
- Confidence60
buildOne report1 publisher An external app with user consent reads mail without holding an account in the tenant
Microsoft's guidance on illicit consent grants says password resets and MFA do not touch the access, and it sends admins to the Purview audit log, where the entry can take up to 24 hours to appear.
Publishers:learn.microsoft.com
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap−12
- Incentives58
- Confidence66
Attackers repurposed prompt injection's invisible Unicode to break email keyword matching
Microsoft's hunt for email-borne prompt injection instead surfaced a three-month phishing campaign hiding tag characters inside words like funding, which puts both problems on one detection team's desk.
Reality
- Evidence58
- Adoption62
- Hype gap+12
- Incentives68
- Confidence55
A hunting signature Microsoft built to catch prompt injection in email started firing on ordinary phishing instead, where invisible tag characters were splitting lure words like "funding" so filters never parsed them.
Perspective Coverage
4 publishers
- Builder
- Builder 31%
- Operator
- Operator 60%
- Investor
- Investor 9%
Reality
- Evidence64
- Adoption72
- Hype gap+16
- Incentives74
- Confidence66