What should organisations do when attackers move from email into messaging apps?

Treat the move as a control transition, not a communication preference. Once an attacker shifts the conversation into LINE, WhatsApp, or Teams, they gain another channel for social engineering, credential harvesting, and payload delivery. Teams should escalate those cases into identity and fraud review, because the risk now spans the user, the account, and the collaboration platform.

Why This Matters for Security Teams

When attackers move from email into LINE, WhatsApp, or Teams, the incident stops being a simple phishing case and becomes an identity, fraud, and platform abuse problem. The channel shift often means the attacker has already established trust, gathered context, or obtained a foothold through a compromised account. At that point, message content can include credential harvesting, payment redirection, malware delivery, or coercive follow-up across multiple systems.

Practitioners should treat the transition as a signal that the adversary is adapting in real time, not merely choosing a more convenient app. That matters because collaboration tools often sit outside email-focused controls, even though they now carry sensitive approvals, file transfers, and impersonation risk. NHIMG has repeatedly documented how identity sprawl and weak secret handling amplify exposure in cross-channel attacks, including the 52 NHI Breaches Analysis and the Ultimate Guide to NHIs — Key Challenges and Risks. The broader pattern also aligns with the attacker tradecraft described in the CISA cyber threat advisories and the MITRE ATT&CK Enterprise Matrix.

In practice, many security teams encounter the real damage only after the conversation has already moved into a trusted chat thread and a second user has been persuaded to act.

How It Works in Practice

The right response is to escalate based on attacker behaviour, not just message medium. Security teams should preserve the original email, the chat transcript, headers, sender metadata, and any linked files or URLs, then correlate them into one case. This is important because attackers often reuse the same lure across channels, changing only the wrapper to bypass user suspicion. A good triage workflow asks: who was impersonated, which account was touched, what permissions were available, and whether the exchange led to a password reset, MFA prompt, payment action, or file upload.

Operationally, teams should route these events into identity review, fraud review, and collaboration platform monitoring at the same time. That usually means reviewing sign-in anomalies, recent token grants, guest access, forwarding rules, and device posture. For platform control, use conditional access, stricter external collaboration settings, and message hygiene controls where the product supports them. For investigation, pair platform logs with threat intelligence and user-reported telemetry from sources such as Anthropic’s AI-orchestrated cyber espionage campaign report and NHIMG’s Top 10 NHI Issues, which help frame how compromised identities and reused access paths become broader abuse chains. In cases where the attacker is asking for code entry, payment confirmation, or token approval, treat the request as a likely business email compromise variant even if it arrived through a messaging app.

• Freeze the thread and collect evidence before deleting or quarantining messages.
• Check whether the account has been used to initiate other chats, invites, or file shares.
• Review whether the attacker obtained session tokens, MFA fatigue leverage, or guest access.
• Notify fraud, identity, and platform owners together so the case is not triaged in isolation.

These controls tend to break down when messaging apps are unmanaged, externally federated, or tied to personal devices because visibility and containment are weaker than in corporate email.

Common Variations and Edge Cases

Tighter response workflows often increase investigation load, requiring organisations to balance speed against false-positive disruption. That tradeoff is especially visible in executive impersonation, vendor payment fraud, and multilingual social engineering, where chat apps are used to bypass the scrutiny that email filters might trigger. Current guidance suggests that teams should not assume a messaging app is lower risk just because the payload is text-only.

There is no universal standard for this yet, but best practice is evolving toward unified detection across email, messaging, and identity telemetry. In some environments, attackers start in email and move to Teams for file delivery; in others, they begin in WhatsApp or LINE and then pivot to email to launder legitimacy. The same case may also involve a compromised non-human identity, such as an integration bot or automation account, which is why NHIMG research on the Ultimate Guide to NHIs — Why NHI Security Matters Now remains relevant here. Security leaders should also watch for attacker use of fake MFA, password reset links, and OAuth consent prompts, since those steps can convert a chat lure into durable account control.

The key exception is high-trust internal channels with strong device and identity controls, where a message may be suspicious but not immediately malicious. Even there, the safest assumption is that a channel transition increases attacker leverage until proven otherwise.

Related resources from NHI Mgmt Group

• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?