QR Code Phishing: Simulate Quishing for UAE Staff

In July 2025 the FBI, CISA, HHS and MS-ISAC warned that a ransomware group was using a fake CAPTCHA that tells the visitor to open the Windows Run window and paste a command. These ClickFix attacks need no exploit, attachment or malicious link, only a person who follows instructions. This post is for SOC leads and security awareness managers in the UAE and GCC who want staff to recognize the lure and stop at the right step.

‍

In short: in ClickFix attacks the victim runs the malicious command personally. The one habit that stops them is to never paste anything into Run, PowerShell or Terminal because a web page asked. Close the page and report it.

‍

How ClickFix Attacks Work

A ClickFix page offers a small problem and a quick fix. The problem can be a CAPTCHA, a missing driver or a fake Blue Screen of Death, as the Cyber Security Agency of Singapore describes. The fix is to copy something, open a system tool and paste it.

‍

In the fake CAPTCHA scam, the page puts a command on the clipboard and then asks the visitor to press Windows key + R, press Ctrl + V and press Enter, the sequence the University of Florida IT security team documents. On macOS the same trick sends the victim to Terminal. The text shown on the page can differ from the command that was actually copied.

‍

The joint advisory on the Interlock ransomware group shows where that path ends: a Base64-encoded PowerShell process that the victim launched personally. Singapore's agency lists credential theft, data exfiltration, email account compromise and possible ransomware as outcomes.

‍

Why a Fake CAPTCHA Scam Works

Most defenses look for what attackers usually need, such as a malicious attachment, a risky link or an exploit. Singapore's agency notes that ClickFix needs none of them and that the command runs through a trusted system shell, which makes detection harder. The final step happens in a window the employee opened on purpose.

‍

The lure also fits ordinary working habits. Picture an accounts payable clerk whose invoice portal will not load on the day before a payment run. A page that promises a thirty-second fix is tempting, and a CAPTCHA is something people click through without a second thought.

‍

That is why the human decision matters so much. The 2026 Verizon Data Breach Investigations Report found the human element present in 62% of the confirmed breaches it analyzed.

‍

The One Habit That Stops It

The habit fits in one sentence. A website never needs you to open Run, PowerShell or Terminal and paste something. If a page says otherwise, close the tab and tell the security team.

‍

It works because it does not depend on recognizing the brand, the wording or the malware family. Lures change and this step does not. The University of Florida guidance puts it as never pasting anything outside your browser when a website asks, and the joint advisory recommends training users to identify, avoid and report social engineering attempts.

‍

Reporting is the second half of the habit. One person's near miss becomes a signal the SOC can act on, for example by checking who else visited the same page. Technical controls back the habit up, and Singapore's agency recommends the following.

‍

• Monitor for malicious PowerShell activity with SIEM tools.
• Enforce least-privilege access.
• Use application allowlisting to block unapproved executables and scripts.
• Keep systems, software and anti-virus current.

‍

ClickFix Awareness Training That Sticks

ClickFix awareness training has one job: make the refusal automatic at the moment of the prompt. A yearly slide about CAPTCHAs does not do that. Short lessons do, when they rehearse the real sequence: a fake check, then Windows key + R, then a paste.

‍

Codex delivers this as agentic AI-driven micro-learning in Arabic and English. The lessons are bite-sized and built on real-world scenarios, and the agentic AI recommends or assigns them to each person from their training gaps and behavioral signals. Role-based learning paths let finance, HR and IT staff see the pretexts that fit their work.

‍

Practice has to follow the lesson, and the email that sends people to a ClickFix page is ordinary phishing. Graybait runs that practice without campaigns, picking each employee's next simulation from their Human Risk Profile. When someone shows a risk, Zero-Touch Training responds with matched coaching in Microsoft Teams, with no manual step.

‍

A related lure, device code phishing, asks for a different input, but the habit of stopping at an unusual request carries over.

‍

What to Do After a Paste

Some staff will paste before they think, so the response needs to be as rehearsed as the refusal. The University of Florida guidance for a managed device gives three steps.

‍

• Disconnect the device from the network.
• Stop using it, but do not shut it down or log off.
• Report it to IT at once.

‍

Make reporting quick and free of blame. People who fear a reprimand stay quiet, and the SOC then learns about the incident from the malware instead of from the employee.

‍

Make the Habit Automatic

Go back to the clerk with the portal that will not load. The goal is that the clerk closes the tab and reports it, because the rule is already part of how they work. Add the paste rule to your next awareness cycle, start with the roles that handle payments and admin access, and track how fast the first report arrives.

‍

Frequently Asked Questions

What are ClickFix attacks?

‍

ClickFix attacks are social engineering lures that show a fake problem, such as a CAPTCHA or an error screen, and tell the visitor to copy a command and run it. The victim opens Run, PowerShell or Terminal and pastes it. The malware then runs because the user launched it, not because of an exploit.

‍

Is ClickFix phishing or malware?

‍

ClickFix phishing is the delivery side: an email or web page that persuades someone to act. The malware arrives only after the victim pastes the command. Singapore's agency reports that phishing emails have redirected victims to these pages, so the first line of defense is still a person who recognizes the lure and reports it.

‍

Does ClickFix affect Mac users?

‍

Yes. The University of Florida describes a macOS version in which the page tells the victim to open Spotlight, launch Terminal and paste a copied command. The tool is different but the habit that stops it is the same: never paste into a system tool because a website asked, and report the page.

‍

Which controls support staff against ClickFix?

‍

Singapore's agency recommends SIEM monitoring for malicious PowerShell activity, least-privilege access, application allowlisting and current software and anti-virus. These controls limit what a pasted command can do. They work best beside a trained habit, because the employee is the one who decides whether to paste.

‍

How should we train staff on ClickFix?

‍

Use short lessons that show the real sequence and state one rule: never paste into Run, PowerShell or Terminal because a page asked. Deliver them in Arabic and English, tailor them to roles, and measure how often and how quickly staff report suspicious pages, not only whether they completed the lesson.

In February 2024, Hong Kong police described a finance employee who sent about US$25.6 million after a video call in which everyone he saw was fake, and that call was what convinced him the request was real. That is the gap deepfake awareness training has to close, and this guide is for CISOs and security awareness managers who need staff to verify voice and video requests from executives.

‍

In short: Deepfake awareness training works when staff learn to treat a voice or face as a claim, never as proof, and to confirm any request for money, access or codes through a channel they choose. Back it with role-specific practice and a written verification process.

‍

Why Deepfake Voice Scams Reach Staff

Voice and video used to be how people settled doubt. Now they are what attackers copy. The FBI warned in May 2025 that criminals use AI-generated audio to impersonate well-known public figures or personal relations, and that a cloned voice can sound nearly identical to the real person. See the FBI public service announcement for the full guidance.

‍

The UAE Cyber Security Council raised the same concern in November 2025. It said the technology can replicate real people's voices and appearances with high accuracy, and it called public awareness the first line of defense against digital misinformation, as The National reported.

‍

The wider fraud picture explains why this reaches the training budget. Reported losses to the FBI's Internet Crime Complaint Center have risen every year, from about $4.2 billion in 2020 to $6.9 billion in 2021, $10.3 billion in 2022, $12.5 billion in 2023, $16.6 billion in 2024 and $20.9 billion in 2025.

‍

‍

Those yearly totals cover all internet crime, so deepfakes are one part of the rise. The IC3's 2025 report also counts 22,364 AI-related complaints with $893 million in losses, and the FBI notes the AI figures may be understated.

‍

What Deepfake Awareness Training Should Teach

Return to the Hong Kong case. The employee first suspected phishing, because the message appeared to come from the company's UK-based CFO and asked for a confidential transaction. The video call removed that doubt, and he found out only when he later contacted head office, as CNN reported. Staff need to learn that a call cannot do that job, because faces and voices are exactly what attackers now reproduce.

‍

That makes the lesson about the request, not about spotting glitches. Hunting for visual flaws gives people a check that can fail without warning. Teach them the shape of the request instead:

‍

• Urgency or secrecy attached to a payment, a credential or a one-time code
• A request that skips the usual approval path
• A sudden move to a new channel or a personal number
• A senior person who cannot be reached to confirm

‍

Then teach one response, the same every time. Stop, leave the channel and confirm through a number or system you already trust. The FBI's advice follows this pattern: find the number yourself and call, never share a two-factor code, and check money requests through a known contact method.

‍

Executive Impersonation Training in Practice

Executive impersonation training lands better when it matches the job. An accounts payable clerk meets a voice note from the CFO asking for an urgent transfer before the day ends. A service desk agent takes a call from someone who sounds like a director and wants a new MFA device registered. Each person needs the same habit, practiced on their own scenario.

‍

This is where Codex fits. It offers role-based learning paths, deepfake awareness lessons and contextual lessons built on real-world scenarios, in Arabic and English. Its agentic AI recommends or assigns short lessons from each person's training gaps, which suits a topic that changes faster than an annual course. In Odin, role criticality weighting means the people who can move money or reset access are not scored like everyone else.

‍

Add a drill your own team runs by hand. Call a finance or service desk employee from an unfamiliar number, use an executive's name, and make a request that should trigger a call-back. Agree with the executive beforehand, and write down what counts as a pass.

‍

Deepfake Fraud Prevention Needs a Process

A trained employee still faces a senior voice saying it is urgent. Deepfake fraud prevention holds up when the process gives that employee permission to say no. Four controls do most of the work:

‍

• A call-back to a number already on file for any payment, bank-detail or access request made by voice or video
• A second approver above a set payment value
• A rule that nobody gives a one-time code by phone, chat or voice note
• A simple way to report a suspected deepfake call straight away

‍

Executives need to know the rule too. If the CFO has told the team that a call-back is always expected, the clerk who calls back is following policy rather than doubting the boss.

‍

Many of these controls already exist for email fraud. The business email compromise training for finance teams covers the payment side, and a deepfake request is the same attack with a familiar voice.

‍

Measure What Staff Do After the Call

Completion rates show who watched a lesson, not who will call back. Track the share of drills where staff verified before acting, how long it took them to report, how many reports of genuinely doubtful calls arrive, and whether the same people or roles repeat the mistake.

‍

When a person shows a security risk, Zero-Touch Training responds at once with training matched to that behavior, delivered inside Microsoft Teams. Training type, frequency and intensity adapt as the person's risk profile changes, so the response arrives when the risk shows up rather than at the next annual course.

‍

Start With One Role

Go back to the Hong Kong employee. The practical next step is to pick the role that can move money fastest, write the call-back rule that role will follow, and run one drill within a month. Then extend the same pattern to the service desk, executive assistants and the executives themselves.

‍

Frequently Asked Questions

What is deepfake awareness training?

‍

It teaches employees that a voice or video of a senior person is not proof of identity, and gives them a fixed way to verify requests for money, access or codes. Good programs use role-based scenarios, short repeated lessons and practice drills rather than a single annual session.

‍

Can employees tell a deepfake voice from a real one?

‍

Not reliably. The FBI notes that AI voice cloning can sound nearly identical to a real contact. That is why training focuses on verification through a trusted channel and on the pattern of the request, instead of asking people to judge how the voice sounds.

‍

How often should deepfake training run?

‍

Short lessons spread through the year work better than one session, because the scenarios change. Add a drill for high-risk roles and a lesson triggered by risky behavior. Frequency should follow each person's role and risk, with finance and service desk staff getting more practice.

‍

Which roles need it first?

‍

Start with the roles that can act on a request alone: accounts payable, treasury, service desk and IT administrators. Executive assistants and the executives being impersonated come next, since the call-back rule only works when senior staff support it and expect to be called back.

On 8 October 2026, Abu Dhabi Police warned businesses about fake supplier emails that ask finance teams to change bank details and send payments to new accounts. Police say the fraud is often discovered only after the transfer is complete. This invoice fraud prevention UAE guide is for finance controllers and CISOs, and it covers the controls and staff habits that apply in every sector.

‍

In short: Treat every bank-detail change as unverified until someone calls a number already on file, require a second approver, authenticate your email domain, and rehearse the change request with the people who receive it.

‍

Invoice Fraud Prevention UAE Starts at the Payee

The scam needs no malware. A criminal takes over or imitates a supplier mailbox, reads the thread about an open invoice, and sends a short note saying the bank account has changed. The accounts payable clerk sees a familiar name, a familiar amount and a plausible reason, so the request looks like routine admin.

‍

The scale is visible in US figures. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with reported losses of about $3.05 billion out of $20.88 billion across all internet crime. That makes this one scam type about 14.6% of everything reported, in the 2025 IC3 annual report.

‍

‍

Abu Dhabi Police describe the same pattern locally, and the warning signs they list are ordinary ones: urgency, a sender domain with a small spelling difference, and an insistence on email over a phone call. Because the signals are ordinary, prevention has to sit in the payment process and in habits staff have practiced, not in instinct alone.

‍

A Bank-Detail Change Procedure, Step by Step

Abu Dhabi Police's guidance, also reported by Emirates 24|7, tells finance teams to verify bank-detail requests through official channels. What decides whether that works is where the phone number comes from, so write the procedure for the vendor master change itself:

‍

1. Log the request on receipt: who received it, when, by which channel and which account details it asks for. Change nothing yet.
2. Take the verification number from the vendor master, created at onboarding or from the signed contract, never from the email, its signature or an attached letter.
3. Call and ask the contact to read back the new account name and number. Record who called, which number, when and who answered.
4. If the known contact cannot be reached, try a second contact on the contract or the supplier's account manager. Leave the existing details in place until someone answers.
5. Have a second authorized employee, who did not take the call, review the log and approve.
6. Hold the first payment to the changed account until the approver has checked that the account holder name matches the supplier's legal name on the contract.

‍

A change request is also a signal. Abu Dhabi Police list urgency, a sender domain with a small spelling difference, an insistence on email over a phone call, and a payment account in a different country from the supplier's usual location as warning signs. Treat each one as a reason to hold the request until a second approver has seen it.

‍

The log is what makes the procedure auditable. Months later, a controller can pull any changed account and see the call, the number and both approvers, which tells you far more than a policy that says verification happened.

‍

Prevention Points by Sector

Bank details change fraud works anywhere suppliers are paid by transfer. Construction invoice fraud UAE cases get the attention, and we cover that chain of developers, contractors and subcontractors in Invoice Fraud in UAE Construction. What differs is who holds the supplier relationship, who can ask for a change and where requests arrive, so adjust these typical set-ups to yours.

‍

Healthcare. In a typical hospital group, procurement owns the supplier relationship and finance runs the payment. Make procurement place the call-back, because it holds the contacts, and keep approval with finance so two functions see every change.

‍

Retail and e-commerce. A payables desk with many logistics and service suppliers sees a steady flow of invoices, so a change request can look like part of the flow. Accept account changes only through one form or ticket, never inside an invoice email, which gives clerks a clear reason to refuse an emailed request.

‍

Higher education. Departments often deal directly with contractors and may forward requests to central payables. Make the central team the only intake point for payee changes, and tell departments that a request passed along by email is not a verified change.

‍

Groups with shared finance teams. One team often pays several entities. Verify and log each change per entity, so a call made for one company is never reused as proof for another.

‍

Who Owns What: Finance and Security

A procedure without owners gets skipped. The controller owns the steps above: who may edit the vendor master, the approval limits, the call log and the hold on first payments. The CISO owns the mailbox side: email authentication with DMARC, DKIM and SPF, and a route for staff to report lookalike domains and odd requests.

‍

Give the two roles a standing exchange. Security sends finance the supplier-related reports it receives, finance sends security the list of bank-detail changes made, and once a quarter both sample changed accounts to confirm each has a call record and a second approver.

‍

The approval step can be automated without removing the person. In Agentic Automation Rules, higher-stakes actions such as a finance approval hold always wait for analyst approval, so the hold is never applied without a person's decision.

‍

Rehearse the Request Before It Arrives

Controls fail at the moment of pressure. The day before a payment run, a supplier writes that the account has changed and the money is due today. A clerk with a written rule, who knows that calling back is expected and not rude, makes the call. A clerk who was only told to be careful often pays.

‍

Make the call-back normal. Say in training and in the procedure that verification is part of the job and that no supplier will be offended by it.

‍

Report what looks odd. A lookalike domain or an unusual urgency is worth a message to the security team, even when the clerk did not act on it. Our guide to business email compromise training for finance teams covers what to teach.

‍

Then test the procedure with the people who run it. Whitebait runs phishing simulation for UAE and GCC organizations, with Arabic and English templates, and tracks reporting rate next to click rate. Send a supplier bank-detail change scenario first to the staff who can edit the vendor master. A reporting rate that rises while the click rate falls tells you the habit is forming.

‍

When someone does act on a doubtful request, the lesson lands best straight away. Zero-Touch Training responds when a person shows a security risk, with training matched to the behavior, delivered inside Microsoft Teams in the flow of work.

‍

Start With One Page

Return to the clerk holding a new account number the day before the payment run. With a log, a verified number and a second approver in place, the request costs a few minutes and the real supplier gets paid. Without them, the transfer can leave before anyone doubts it.

‍

This week, write the six steps on one page, name who places the call in each team, and share it with everyone who can edit a supplier record.

‍

Frequently Asked Questions

What is bank details change fraud?

‍

A criminal impersonates a supplier, or uses a compromised supplier mailbox, and emails a request to pay future invoices into a new account. Abu Dhabi Police warn that it is often discovered only after the transfer is complete, so the check has to happen before the payment leaves.

‍

What if we cannot reach the supplier's known contact?

‍

Leave the existing bank details in place and try a second contact on the contract or the supplier's account manager. Never use a number from the request itself. If the payment is due, tell the approver and record the delay, because a late payment can be explained to a supplier and a payment to the wrong account may not be recoverable.

‍

Who owns invoice fraud prevention, finance or security?

‍

Both. The controller owns the procedure, the approval limits and the call log. The CISO owns mailbox security and the route for staff to report suspicious requests. Reviewing a sample of changed accounts together each quarter keeps either side from assuming the other has checked.

‍

Does the same procedure fit every sector?

‍

The steps stay the same. What changes is who places the call and where requests enter: procurement in a hospital group, one form or ticket in retail, central payables in a university. Decide those two points for your own organization, then apply the six steps without exceptions.