Microsoft's 2026 Digital Defense Report highlights a significant resurgence of phishing as a primary attack vector. Phishing was the initial access method in 23% of intrusions, a substantial increase from the previous year. The nature of phishing has also evolved, with Adversary-in-the-Middle (AiTM) techniques now accounting for nearly half of identified phishing methods. AiTM kits work by creating a reverse proxy that captures not just passwords, but also active session cookies. This means traditional multi-factor authentication methods like SMS codes and authenticator app approvals are ineffective against AiTM. These methods forward the authentication code in real-time, effectively bypassing the security measure. Phishing-resistant authentication methods, such as FIDO2 security keys and passkeys, are recommended as they are tied to the website's address and thus cannot be exploited by proxies. Attackers are employing new delivery tricks, including QR codes within PDFs and CAPTCHA gates, to bypass security filters. They also use device code phishing and impersonate IT support through chat messages to trick users. Organizations are advised to implement passkeys or FIDO2 keys for critical accounts, monitor session lengths, treat QR codes in attachments cautiously, educate staff about help desk contact protocols, and maintain strict email domain authentication. While the FanMail platform offers some protective measures, it cannot make traditional MFA phishing-resistant; therefore, implementing phishing-resistant authentication in front of email is crucial.