October is Cybersecurity Awareness Month, and this year is a good reminder that cybersecurity does not have to be complicated to be effective. This year's month long them is Secure Our World which encourages everyone to take four core steps: recognize and report phishing, use strong passwords, turn on multifactor authentication, and update software.

This week begins our October series with the threat that starts many cyber incidents: phishing.

This week's issue brings the return of recognizing our weekly "Cybersecurity All-Stars". I had stopped doing this for some reason. So, beginning this week that error will be corrected.

Week of September 20-27

• Kris Hines
• Barb Lionti
• Staci King

Well done. Stop by the IT Department to claim your All-Star merch and show off your cybersecurity skills to your work mates.

From Microsoft:

Approximately 8.3 billion email-based phishing threats were detected from January through March 2026 alone. Microsoft says 78% were link-based, credential phishing remained the dominant malicious-payload objective, QR-code phishing more than doubled during the quarter, and CAPTCHA-gated phishing continued evolving.

Lessons we can learn from this report.

MFA alone is no longer enough. Several major campaigns are designed specifically around stealing tokens or manipulating MFA authentication flows.

The help desk has become part of the attack surface. Voice phishing that impersonates IT support deserves the same awareness emphasis as malicious email.

Identity is increasingly the perimeter. Microsoft 365, Entra ID, Okta, VPN, and other SSO (single sign on) credentials give attackers a much more valuable target than an individual endpoint.

Phishing is still one of the most common ways cybercriminals steal passwords, money, and personal information. A phishing message may arrive by email, text message, social media, QR code, phone call, or even a collaboration tool. It may look like it came from a bank, delivery company, technology provider, government office, supervisor, vendor, or friend. The goal is almost always the same: get you to click, scan, download, sign in, pay, or share information before you have time to think.

Modern phishing messages often look polished and believable. Scammers can copy logos, create realistic websites, and use information from data breaches or social media to make a message feel personal. That is why the old advice to look only for misspellings or bad grammar is no longer enough. A message can look professional and still be dangerous.

The best defense is to slow down and verify. If a message asks you to act urgently, use a link or QR code, approve a sign-in, send money, change payment information, or provide a security code, pause. Go directly to the official website or app, call a known phone number, or start a separate message to confirm the request. Do not use the contact information provided in the suspicious message.

Be cautious with unexpected messages that ask you to click, scan, download, pay, verify, or act immediately.

Do not sign in through links sent by email, text message, social media, or QR code unless you are certain they are legitimate.

Use official websites, apps, bookmarked pages, or known phone numbers to verify requests.



Report suspicious messages quickly so others can be protected.

Phishing works because it takes advantage of trust, urgency, and distraction. Cybersecurity Awareness Month is a good time to build the habit of pausing before you click, scan, pay, or approve. A few extra seconds of caution can prevent a stolen password, fraudulent payment, malware infection, or account takeover.

Cybersecurity Awareness Month continues next week as we change our focus to the importance of passwords and password managers.