They succeed because many controls still rely on known bad indicators such as suspicious senders, malformed language, or blacklisted links. When attackers use legitimate domains, hosted documents, and realistic approval threads, those signals disappear. The result is a trust failure, not just a filtering failure, because the email appears to fit normal business communication and bypasses user sanity checks.
Why This Matters for Security Teams
Phishing that uses real platforms and lookalike domains works because it attacks the trust layer that standard email defences assume is already reliable. If a message arrives from a legitimate service, threads through a real collaboration platform, or imitates an internal workflow closely enough, many gateway checks lose their value. That is why this problem belongs as much to identity and trust governance as to email filtering. Guidance from CISA cyber threat advisories is useful here because it consistently shows how attackers blend infrastructure, social engineering, and credential theft into one chain rather than relying on a single malicious indicator.
The operational risk is not limited to a bad click. Once a user approves a request, opens a shared file, or reauthenticates into a lookalike service, the attacker can move into identity capture, session hijack, or business email compromise. Standard defences often still optimise for known-bad sender reputation instead of contextual trust signals such as domain similarity, thread integrity, and real-time authentication events. In practice, many security teams discover the weakness only after a valid account has been abused or a fraudulent approval has already been completed, rather than through intentional detection of the lure pattern.
How It Works in Practice
These campaigns succeed because they mimic the normal mechanics of business communication, not because they are technically sophisticated in isolation. A common pattern is a real platform account or tenant sending a request that appears internally consistent, while the attacker uses a lookalike domain, compromised mailbox, or benign-hosted document to keep the message clean. The content may be short, bland, and free of malware, which means signature-based controls have little to flag.
Detection has to look beyond the message body and evaluate the surrounding trust context. That usually means correlating multiple signals:
- Domain resemblance and newly registered infrastructure.
- Sender authentication results such as SPF, DKIM, and DMARC, plus any forwarding or delegation anomalies.
- Conversation-thread integrity, including changes in reply patterns or display-name spoofing.
- Identity and device context, especially impossible travel, unfamiliar sessions, or unusual privilege requests.
- File-sharing behaviour and external collaboration links that do not match normal workflow.
For attack-pattern thinking, the MITRE ATT&CK Enterprise Matrix is helpful because it frames the campaign as a chain: initial access, credential access, and then execution through legitimate tools or services. That matters more than whether the lure looked “suspicious” at first glance. Mature programs also feed mailbox telemetry into SIEM and SOAR so analysts can compare the original email against subsequent identity events and lateral movement signals. These controls tend to break down in heavily delegated mail environments and high-volume external collaboration workflows because legitimate exceptions drown out the behavioural anomalies.
Common Variations and Edge Cases
Tighter email and identity controls often increase friction for users, requiring organisations to balance interception strength against business latency and false positives. That tradeoff is especially visible when phishing uses sanctioned platforms, because aggressive blocking can interrupt real workflows while permissive policies leave a wide trust gap. Current guidance suggests there is no universal standard for this yet; the best outcome usually comes from layered controls rather than a single “perfect” detector.
Edge cases matter. Executive assistants, finance teams, and procurement workflows are often exposed because they routinely handle time-sensitive approvals and external coordination. Contractor-heavy environments and mergers create further ambiguity, since new domains, shared drives, and unfamiliar collaboration patterns can look normal even when they are not. Where identity verification is weak, the message does not need to be perfect if the downstream approval path is already trusted. That is why this problem sits at the intersection of email security, identity assurance, and privilege governance rather than being solved by spam filtering alone. When organisations rely only on reputation-based controls, attackers simply move to legitimate services and wait for human process to do the rest.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA | Identity assurance is central when phishing bypasses content filters through trusted platforms. |
| MITRE ATT&CK | T1566 | Phishing remains the core delivery technique behind these trust-based lures. |
| NIST SP 800-53 Rev 5 | SI-4 | Monitoring must detect behavioural anomalies, not just malicious attachments or links. |
Map detection and response coverage to phishing delivery paths and follow-on credential abuse.
Related resources from NHI Mgmt Group
- Why do AI-driven phishing attacks still succeed when organisations use modern authentication?
- Why do phishing attacks against cloud apps succeed even when email security is in place?
- Why do phishing-resistant methods still fail against man-in-the-middle attacks?
- Why do phishing attacks succeed so often against small businesses?
