Today's Security Alert (2026-02-27)

This is the weekly personal security brief. This week’s focus is phishing-resistant two-factor authentication (passkeys/security keys).

Key terms (quick setup)

• Two-factor authentication: Sign-in protection that uses a second factor beyond your password (device, biometrics, hardware key, etc.).
• Phishing resistance: Authentication that is hard to steal even when attackers use fake pages/messages.
• Passkeys / security keys: Methods that verify the real site before authenticating, making them stronger than one-time code flows against phishing.

Recent news directly tied to this theme

1) Microsoft warning: phishing via Device Code auth flows

• Source: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-russian-phishing-attacks-via-device-code-auth-flows/
• Explanation: Attackers abuse legitimate-looking authentication steps and trick users into entering codes in a malicious flow.
• What to watch out for: Never start sign-in from links in email/DM. Open the service from your app or trusted bookmark.
• Who to contact: For work accounts, contact your internal IT/security team; for personal accounts, contact official support.

2) OAuth-themed Gmail phishing that looks legitimate

• Source: https://www.bleepingcomputer.com/news/google/new-gmail-phishing-attack-uses-google-oauth-and-looks-legit/
• Explanation: The attack imitates legitimate Google consent screens, exploiting trust in familiar UI.
• What to watch out for: Before approving, verify app name, requested permissions, and the exact path you followed.
• Who to contact: Google Account security checkup and official Google Help channels.

3) ClickFix surge: fake CAPTCHA to force risky manual actions

• Source: https://www.bleepingcomputer.com/news/security/clickfix-attacks-increased-517-percent-in-second-half-of-2025/
• Explanation: Users are pushed into unsafe “extra verification” steps (copy/paste or command execution), often after fake trust prompts.
• What to watch out for: If CAPTCHA asks you to run commands, stop immediately and close the page.
• Who to contact: If you suspect device compromise, use official OS/vendor support or a trusted security support provider.

4) Google: passkeys becoming the default path for personal accounts

• Source: https://blog.google/innovation-and-ai/technology/safety-security/passkeys-default-google-accounts/
• Explanation: Google moved personal accounts toward passkeys by default, signaling practical consumer adoption of phishing-resistant sign-in.
• What to watch out for: Enable passkeys first on critical accounts (email, cloud, payments) and set recovery options at the same time.
• Who to contact: Official passkey setup/recovery documentation from your service and device vendor.

This week’s practical takeaway

• Two-factor authentication is essential, but where possible, prefer phishing-resistant authentication (passkeys/security keys).
• Focus less on how “real” a screen looks, and more on how you got there.
• If compromise is suspected, preserve evidence (URL, timestamp, screenshots) and contact official support quickly.