The Four Awareness Month Habits, Tested Against 2026 Tradecraft

October is Cybersecurity Awareness Month, and the National Cybersecurity Alliance’s 2026 theme is “Don’t Make It Easy for Them.” The campaign rests on four habits: use strong passwords and a password manager, turn on MFA, recognize and report scams, and keep software updated.

Those are the right habits for the general public. For security teams, the more useful exercise is to take each one and test it against what attackers are doing this year. Every habit still holds up. In each case, though, the attack has moved to the point right after the user does the right thing.

The NCA’s own research shows the starting gap. Its five-year Oh Behave! study found MFA awareness rose from 52% in 2021 to 77% in 2025, while regular MFA use fell to 53% after peaking in 2022. Phishing accounted for 40% of the incidents respondents reported in 2025.

What follows is each habit, the 2026 tradecraft that works around it, and the control that has to hold when the habit isn’t enough.

Strong Passwords and a Password Manager

#

A password manager has a security property most users never notice: it fills credentials only on the domain they were saved for. The vishing campaigns that ran through 2026 are built to get around exactly that.

ShinyHunters-linked operators call employees while posing as IT staff, tell them their MFA settings need an update, and send them to a victim-branded credential harvesting site. Incident-response investigators documented those domains following patterns like <companyname>sso.com and <companyname>internal.com. Once the operators have the SSO credentials and MFA codes, they register their own device for MFA and keep the access.

The pattern hasn’t faded. On August 22, 2026, a security services provider was targeted the same way: a typosquatted copy of its SSO portal behind a CDN, and calls from someone posing as a named member of its own security staff.

Password strength doesn’t factor into any of this, because the user typed the password in for them. When the password manager declined to autofill on a lookalike domain, it was flagging the problem. The caller’s job is to talk the user past it.

What has to hold:

• Origin-bound authenticators. FIDO2 security keys and passkeys are tied to the real domain, so a lookalike site never receives a usable assertion.
• Gated MFA enrollment. Registering a new factor should require an existing strong factor or a verified help desk process, not a fresh password and a one-time code.
• Enrollment alerting. Alert on MFA method registration and lifecycle changes, especially outside business hours. Watch for new mail add-on or app authorizations too, since they’ve been used to delete the enrollment notification before the user sees it.

Turn On MFA

#

CSuite, a financially motivated phishing operation documented in sandbox telemetry research on September 22, 2026, shows the second gap. One of its branches never asks for a password.

The lure page displays a short code and sends the victim to the identity provider’s genuine device login page. Entering the code authorizes an OAuth request the attacker started, and the attacker receives access and refresh tokens. Everything the victim sees after the lure belongs to the real identity provider. The lures were themed as shared documents, e-signature requests, and voicemail notifications.

The operation’s credential branch takes a different route to the same result. It captures the password and a live session, keeps the session alive, and gives the operator a mailbox that doesn’t prompt for a second factor again.

In both branches, MFA was on and the user completed it.

What has to hold:

• Restrict the device code flow. Limit it by policy to the users and device types that need it, such as conference room hardware and specific CLI tooling. For most workforce accounts, the right setting is block.
• Correlate identity and endpoint signals. Device code sign-ins and new OAuth grants are detection signals on their own. CSuite runs its credential and remote-access arms off shared infrastructure, so a device code sign-in and a new management agent on the same user’s endpoint belong in the same investigation.
• Contain more than the password. A password reset doesn’t reliably end a stolen session. Revoke sessions and refresh tokens, review OAuth grants and mailbox rules, and check the endpoint for remote-management agents.

Recognize and Report Scams

#

Recognition training leans heavily on one cue: check where you are. A ClickFix campaign documented on September 28, 2026 removed that cue from nearly every step.

Victims searched for “chatgpt” and clicked a sponsored result that landed on a Custom GPT hosted on the real chatgpt.com domain, titled “Plus 5.6” so it would read like a new model. Any prompt returned a service availability notice pointing to a “backup domain” on Google Sites. That page served a fake CAPTCHA instructing the user to paste a PowerShell command.

The command pulled an MSI that sideloaded a malicious DLL through a legitimately signed application, the same DLL side-loading pattern covered in the SLEEPWALKER detection notes. It set up a Run key and a scheduled task with matching names and delivered a full-featured remote access trojan. Investigators responded to at least 40 incidents tied to the campaign’s Google Sites page. After the first Custom GPT was taken down on September 25, a replacement turned up two days later.

Two details stand out for defenders. The delivery server was written as a decimal number instead of a dotted IP address, so URL filters looking for an IP never matched. And in one incident, endpoint protection quarantined the installer after it had already run. The persistence it created kept the chain going anyway.

The habit that still works here is behavioral: no legitimate verification check asks you to open a terminal or the Run dialog and paste something. That message is short enough to survive a busy week, and it doesn’t depend on reading a URL correctly.

For user populations that never need it, removing the Run dialog through Group Policy and constraining PowerShell for standard users narrows the paste-and-run path. ClickFix variants also use the terminal and the File Explorer address bar, so this adds friction rather than closing the technique.

The reporting half of this habit is the part that scales. When a campaign reaches dozens of users, the first report can shorten the response for everyone after it. A one-click report button that sends an acknowledgment back does more for that than another module on spotting fake CAPTCHAs.

Keep Software Updated

#

This habit has two developments worth tracking, and the first one turns the habit itself into the lure.

CSuite’s delivery pages showed a counterfeit PDF viewer with a “View Update” button. In one captured sample, the file it delivered was a 324-byte batch script. The script checked for administrative rights, relaunched itself through a UAC prompt if it didn’t have them, and installed a legitimate remote-management client from a public code-hosting repository. Other variants installed endpoint-management agents enrolled into a tenant the operator controls. The user was doing what a decade of awareness content told them to do.

What has to hold:

• Managed update channels. Updates arrive through managed tooling, never from a document or a web page, and users should hear that stated plainly.
• No local admin for standard users. The batch script depended on the victim clearing a UAC prompt. Without local admin rights, that prompt asks for credentials the user doesn’t have.
• An allowlist for remote-management tools. Application control that permits only sanctioned RMM agents turns an unsanctioned install into a block or an alert. The second development is how update priority gets communicated. On September 28, 2026, CISA discontinued its weekly CVSS-based Vulnerability Bulletin. The agency tied the change to BOD 26-04, which directs federal agencies to prioritize by evidence of exploitation and exposure rather than severity scores alone. Risk-focused information continues through the KEV Catalog, CISA alerts and advisories, and CVE records. It’s the same direction argued in the case against severity ratings as the primary patch signal.

The consumer version of this habit still matters too. CISA added an actively exploited browser JavaScript engine flaw to the KEV Catalog on September 4, 2026. Browser updates apply on restart, and long-running browser sessions are where that gap tends to sit.

What the Four Have in Common

#

Each habit asks the user to notice something: a wrong domain, an unexpected prompt, a suspicious page, an outdated version. Each technique above works by making the noticing irrelevant.

The password went to a page built to look like the company’s own. The MFA prompt was real. Nearly every domain in the ClickFix chain was legitimate. The update prompt was the attack.

The controls that held in each case don’t depend on the user noticing anything: origin-bound authenticators, restricted authentication flows, gated MFA enrollment, managed update channels, no local admin, and behavioral detection on the endpoint.

Updating the October Message

#

If you’re writing user-facing content this month, four lines map directly to the tradecraft above:

1. If your password manager won’t fill in your password, stop. Don’t type it in by hand.
2. IT will never call to change your MFA settings or ask you to approve a prompt. Hang up and call the help desk number you already have.
3. Never enter a code from an email, chat, or web page into a sign-in screen you didn’t open yourself.
4. Real verification checks never ask you to paste a command, and real updates never come from a document or a web page. The NCA’s theme holds up well for 2026. For security teams, the work this month is making sure the control behind each habit holds when the habit isn’t enough.

Sources

#

• Cybersecurity Awareness Month 2026, National Cybersecurity Alliance
• Oh Behave! Cybersecurity Attitudes and Behaviors Report, 2021 to 2025, National Cybersecurity Alliance
• Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft
• Cyber Incidents TLP WHITE: ShinyHunters-Linked Social Engineering and Identity-Targeting Campaign, H-ISAC via AHA
• CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
• CISA to Sunset Weekly Vulnerability Bulletin on September 28, 2026, CISA
• CISA Adds One Known Exploited Vulnerability to Catalog, September 4, 2026, CISA