Email is still where most fraud and many intrusions begin, and the costliest attacks now arrive from real, compromised mailboxes that pass every authentication check. The FBI's 2025 Internet Crime Report records 191,561 phishing and spoofing complaints, the highest count of any crime type, and $3.05 billion lost to business email compromise from 24,768 complaints. This list ranks the ten email threats defenders should plan for, with the signals that reveal each one, the controls that stop it and the matching MITRE ATT&CK techniques. It is written for email administrators, SOC analysts and security architects and contains no attacker procedures.
The Top 10 at a glance
The ranking weighs reported financial loss (IC3 2025), how often each threat appears in government advisories, and how much access one success gives an attacker. Several threats chain together: an AiTM phish (2) yields a mailbox, which enables thread hijacking (5) and BEC (1).
| # | Threat | Main ATT&CK technique | Strongest control |
|---|---|---|---|
| 1 | Business email compromise and payment fraud | T1586.002, T1534 | Out-of-band verification of payment changes |
| 2 | Credential phishing and AiTM session theft | T1566.002, T1557, T1550.004 | Phishing-resistant MFA (FIDO2, certificate-based) |
| 3 | Malicious attachments and HTML lures | T1566.001, T1204.002 | Attachment type blocking, macro and script controls |
| 4 | QR code phishing (quishing) | T1566.001, T1566.002 | QR-aware filtering, managed mobile protection |
| 5 | Thread hijacking from compromised accounts | T1586.002, T1534 | Account compromise detection, inbox rule alerts |
| 6 | Lookalike and cousin domains | T1583.001, T1585.002 | Domain monitoring, external sender tagging |
| 7 | Direct domain spoofing through DMARC gaps | T1566 | DMARC at p=reject on all domains |
| 8 | OAuth consent phishing | T1528 | Restricted user consent, admin consent workflow |
| 9 | Malicious inbox rules and auto-forwarding | T1564.008, T1114.003 | Block external auto-forwarding, rule monitoring |
| 10 | Callback and help-desk-themed phishing | T1566.004, T1219 | RMM allowlisting, verified support channels |
1. Business email compromise and payment fraud
The threat: an attacker impersonates or takes over a supplier, executive or solicitor and asks for a payment or bank detail change. IC3 notes that BEC now extends beyond email to phone numbers and virtual meeting applications, and that businesses reported over $30 million in losses to BEC scams involving AI, including voice cloning.
Detect: requests to change bank details, urgency combined with secrecy, first-time payees, and replies whose Reply-To differs from From.
Prevent: a finance rule that every bank detail change is confirmed by calling a number already on file, never one in the message; dual approval above a threshold; and fast escalation to your bank's fraud team, since recall success falls quickly. See the Email Identity and BEC Guide and Business Email Compromise Response Playbook.
2. Credential phishing and AiTM session theft
The threat: a proxy phishing page relays the real sign-in, so the user completes MFA and the attacker captures the session cookie. Microsoft described a campaign that targeted more than 10,000 organisations this way and stressed it is not a vulnerability in MFA; stolen cookies were sometimes used in Outlook on the web within five minutes.
Detect: sign-ins from anonymisers or unusual ISPs, one session used from two networks, and a new inbox rule shortly after sign-in.
Prevent: FIDO2 or certificate-based authentication, starting with finance and administrators; Conditional Access requiring compliant devices; browser and URL protection. See the AiTM Phishing Guide and Phishing-Resistant MFA Guide.
3. Malicious attachments and HTML lures
The threat: files that run code or lead to credential pages: HTML attachments posing as voicemail, password-protected archives, disk images and Office documents with macros.
Detect: sandbox verdicts, encrypted archives from external senders, and Office or script hosts spawning child processes on endpoints.
Prevent: CISA's #StopRansomware Guide advises filtering risky attachment types and reviewing the list at least twice a year, noting that password-protected archives evade scanning; it also advises disabling macros in Office files received by email and disabling Windows Script Host. Pair this with attack surface reduction rules or application control on endpoints.
4. QR code phishing (quishing)
The threat: the link sits inside an image or PDF as a QR code, so URL rewriting cannot see it and the user opens it on a personal phone. The Western Australian SOC warned in September 2023 that because codes are scanned on mobile devices, the clicks happen off the corporate network where gateways and the SIEM are unlikely to see them.
Detect: hunt for external emails whose body is mainly an image or single-page PDF with authentication themes (MFA reset, document share); ask affected users whether they scanned and entered credentials.
Prevent: filtering that decodes QR codes, mobile threat protection on managed phones, and phishing-resistant MFA so captured passwords are not enough. See the QR Code Phishing (Quishing) Guide.
5. Thread hijacking from compromised accounts
The threat: the attacker replies inside a genuine conversation from a real mailbox, often at a supplier. In the Microsoft AiTM campaign, attackers searched finance threads, replied in existing invoice conversations and deleted their sent items. SPF, DKIM and DMARC all pass because the mail is authentic.
Detect: a known correspondent suddenly sending new bank details, links to file shares, or messages from unusual geographies; bursts of internal messages from one account (internal spearphishing).
Prevent: treat payment detail changes as untrusted regardless of sender (threat 1), share indicators with suppliers quickly, and contain compromised accounts with session revocation, not only a password reset. See the Phishing Incident Response Playbook.
6. Lookalike and cousin domains
The threat: domains one character away from yours or a supplier's, or using a different top-level domain, pass authentication checks for the attacker's own domain. CISA's Scattered Spider advisory (AA23-320A) describes phishing and smishing with victim-specific lookalike domains.
Detect: new domain registrations similar to yours and your key suppliers, and first-contact senders whose display name matches an internal executive.
Prevent: external sender tagging, display-name impersonation protection for executives and finance, defensive registration of the most obvious variants, and a takedown process.
7. Direct domain spoofing through DMARC gaps
The threat: without an enforced DMARC policy, anyone can send mail with your exact domain in the From header. Parked domains with no SPF or DMARC are a common gap.
Detect: DMARC aggregate (rua) reports showing unknown sources, and failures at p=none that would be rejected under enforcement.
Prevent: move from p=none through quarantine to p=reject, publish restrictive records on non-sending domains, and add MTA-STS for inbound TLS. The NCSC recommends running MTA-STS in testing mode with TLS-RPT for at least a month before enforcing. Since February 2024, Google and Yahoo require bulk senders to publish DMARC (at least p=none) with SPF or DKIM alignment; Google began rejecting non-compliant traffic more firmly from November 2025. Note that p=none meets their rule but does not stop spoofing. See the DMARC, SPF and DKIM Guide.
8. OAuth consent phishing
The threat: a link asks the user to grant a malicious app access to mail or files. The grant survives password resets and MFA changes.
Detect: new consent grants with high-impact scopes such as Mail.Read or offline_access, apps from unverified publishers, and apps reading mail at volume.
Prevent: in Microsoft Entra ID, Microsoft recommends allowing user consent only for verified publishers and low-impact permissions (policy microsoft-user-default-low) with the admin consent workflow for the rest; changing the setting does not revoke existing grants, so review them. The Microsoft verified publisher OAuth phishing case shows how malicious apps reached mailboxes. See the Consent Phishing and Illicit OAuth Grants Guide.
9. Malicious inbox rules and auto-forwarding
The threat: after taking a mailbox, attackers create rules to hide replies or forward mail externally. Microsoft observed rules that moved replies from fraud targets to the Archive folder and marked them read.
Detect: New-InboxRule and Set-InboxRule events in the unified audit log, rules that move, delete or mark as read mail containing words such as invoice or payment, and new external forwarding.
Prevent: block automatic external forwarding by default (in Exchange Online, through the outbound spam policy) with documented exceptions, and include rule and forwarding review in every account compromise response.
10. Callback and help-desk-themed phishing
The threat: the email contains no link, only a phone number for a fake renewal or IT issue, so filters see nothing malicious. CISA advisory AA23-025A describes help-desk-themed emails that led staff to download portable ScreenConnect and AnyDesk, which run without installation or admin rights.
Detect: execution of unapproved remote access tools, and messages with invoice themes and phone numbers but no links.
Prevent: application allowlisting that blocks unapproved RMM tools, a single published channel for IT support, and user reporting. See the Callback Phishing (TOAD) Guide.
Mapping to MITRE ATT&CK
| Threat | ATT&CK technique (v20) | Tactic |
|---|---|---|
| 1, 5. BEC and thread hijacking | T1586.002 Compromise Accounts: Email Accounts; T1534 Internal Spearphishing | Resource Development; Lateral Movement |
| 2. AiTM phishing | T1566.002 Spearphishing Link; T1557 Adversary-in-the-Middle; T1550.004 Web Session Cookie | Initial Access; Credential Access; Lateral Movement |
| 3, 4. Attachments and QR lures | T1566.001 Spearphishing Attachment; T1204.002 Malicious File | Initial Access; Execution |
| 6. Lookalike domains | T1583.001 Acquire Infrastructure: Domains; T1585.002 Establish Accounts: Email Accounts | Resource Development |
| 7. Spoofing | T1566 Phishing | Initial Access |
| 8. Consent phishing | T1528 Steal Application Access Token | Credential Access |
| 9. Rules and forwarding | T1564.008 Email Hiding Rules; T1114.003 Email Forwarding Rule | Stealth; Collection |
| 10. Callback phishing | T1566.004 Spearphishing Voice; T1219 Remote Access Tools | Initial Access; Command and Control |
Measure progress with a small set of metrics: share of domains at DMARC p=reject, share of finance and admin users on phishing-resistant MFA, median time from user report to mailbox-wide purge, number of external auto-forwarding rules, and payment change requests verified out of band.
Where to start
- Lock the payment process: mandatory call-back verification and dual approval for bank detail changes stop threats 1 and 5 even when every technical control fails.
- Phishing-resistant MFA for finance, executives and administrators: this neutralises AiTM and most credential phishing for the accounts attackers want.
- Enforce DMARC: get every sending and parked domain to p=reject using aggregate reports, then add MTA-STS.
- Close mailbox persistence: block external auto-forwarding, alert on suspicious inbox rules and restrict user consent to apps.
- Tune detection and response: QR-aware filtering, a one-click report button, and a playbook that revokes sessions and purges messages. See the Email Security Guide.
Related NHI Mgmt Group resources: Top 10 Phishing Techniques · Phishing Guide · Email Security Buyer's Guide · Top 10 Online Fraud Attacks