Low-volume campaigns that target a small share of visitors can stay hidden long enough to harvest credentials or approvals. Volume-based detection misses these operations because the attacker is optimizing for secrecy, not scale. Teams need telemetry that spots unusual redirects, compromised websites, and sign-in anomalies even when overall traffic stays low.
Why This Matters for Security Teams
High-volume phishing is only one attack shape, and it is often the easiest one to spot. The more dangerous pattern is selective targeting: a small number of visitors, a narrow identity set, or a single approval path. That matters because modern phishing operations are frequently designed to capture session tokens, OAuth grants, or privileged approvals rather than mass credentials. NHI Mgmt Group notes that only 5.7% of organisations have full visibility into their service accounts, which is a useful reminder that low-visibility identity paths are where attackers hide.
Teams that rely on message counts, mail gateway volume, or obvious campaign bursts will miss the quieter path from compromised website to sign-in anomaly to downstream account abuse. Current guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls supports broader monitoring of identity events, but the operational challenge is correlating them with web and access telemetry fast enough to matter. In practice, many security teams encounter the breach only after a token has already been used or an approval has already been granted, rather than through intentional detection.
How It Works in Practice
Detecting low-volume phishing requires shifting from campaign counting to behaviour correlation. Instead of asking how many messages were sent, security teams should ask whether a small set of users was redirected to an unusual domain, whether the site path matched a known lure pattern, and whether the subsequent sign-in came from a new device, geolocation, or application consent flow. This is especially important when the attacker is harvesting OAuth grants or session cookies, because the initial lure may look like a normal login prompt.
Practitioners should tie together web proxy logs, email telemetry, identity provider events, and endpoint or browser signals. The goal is to spot a chain such as: suspicious redirect, credential entry, atypical token issuance, then a new inbox rule, MFA prompt fatigue, or privilege escalation. That aligns with the broader NHI governance view in Ultimate Guide to NHIs, because once a token or API key is stolen, the compromise behaves like an identity event, not just a phishing event. It also matches recent research such as CoPhish OAuth Token Theft via Copilot Studio, where the abuse path centred on authorisation and token capture rather than broad-volume delivery.
- Alert on unusual redirects to newly registered or rarely seen domains.
- Correlate low-volume lures with abnormal sign-in, consent, and token issuance events.
- Flag first-seen applications, consent grants, and inbox or forwarding rule changes.
- Investigate whether the same identity is used to access mail, SaaS, and admin consoles shortly after a lure.
These controls tend to break down in environments with fragmented identity logs, unmanaged BYOD browsers, or SaaS applications that do not expose enough token and consent telemetry.
Common Variations and Edge Cases
Tighter phishing controls often increase investigation overhead, requiring organisations to balance better correlation against analyst fatigue and logging cost. That tradeoff is real because low-volume attacks can resemble normal user behaviour until enough context is assembled. There is no universal standard for how much signal is enough; current guidance suggests prioritising identity-linked telemetry over simple message scoring.
Some attacks do not begin in email at all. A compromised website, malicious ad, or third-party portal can redirect a user into a credential harvest without any obvious mail volume. Other cases involve a single high-value user, such as finance or help desk staff, where one successful login is more damaging than a thousand blocked emails. NHI Mgmt Group research on the Poland Military Breach shows how targeted identity abuse can matter more than scale when the attacker is after access and trust rather than mass distribution.
Security teams should also account for services that use shared accounts, API keys, or delegated access. In those cases, the visible phishing event may be the least important signal, because the real impact lands later through reused tokens or non-human identities that were never part of the original detection logic.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Low-volume phishing often leads to stolen NHI secrets and token abuse. |
| OWASP Agentic AI Top 10 | A1 | Agentic systems can be tricked into approval or token-grant abuse by small-lure phishing. |
| CSA MAESTRO | IDM-02 | Identity telemetry and authorization events are central to spotting targeted phishing. |
| NIST CSF 2.0 | DE.CM-1 | Continuous monitoring is needed beyond email volume to detect targeted phishing. |
| NIST AI RMF | GOVERN | Selective phishing of AI or automated workflows requires governance over identity and access paths. |
Define ownership for identity-linked telemetry and response decisions across human and machine accounts.
