Phishing that uses real organisational, personal, or business context to make a lure appear legitimate. Attackers harvest public metadata, social profiles, and brand signals to lower suspicion and increase click or execution rates before any technical payload is delivered.
Expanded Definition
Context-rich phishing is a lure strategy that uses legitimate-looking details from an organisation, person, or business relationship to make a message feel routine and trustworthy. The attacker may reference a real project name, a known supplier, a recent meeting, a manager’s title, or a publicly visible service workflow to reduce suspicion before any malicious link, attachment, or credential prompt appears.
In NHI security and IAM operations, the term is often adjacent to business email compromise, social engineering, and pretexting, but it is more specific because the lure is built from verifiable context rather than generic spam. Guidance varies across vendors on how to classify these campaigns, but the operational concern is consistent: context is being weaponised to induce action. This matters when the target is not only a human user but also an AI agent or workflow with execution authority. The most common misapplication is treating context-rich phishing as a simple awareness problem, which occurs when defenders ignore how organisational metadata and identity signals are assembled into the lure.
For baseline identity and control framing, NIST Cybersecurity Framework 2.0 helps situate this threat within access, awareness, and response priorities, while NIST guidance on digital identity and zero trust is useful when the lure aims to manipulate trust decisions rather than exploit code directly.
Examples and Use Cases
Implementing detection and response for context-rich phishing often introduces a tradeoff between stronger validation and faster business communication, requiring organisations to weigh friction against reduced exposure.
- A supplier impersonation email references a real procurement ticket and a known invoice cycle, pushing an employee to approve a payment or update banking details.
- A message to an engineering team cites a current release branch and asks for a “quick secret rotation check,” attempting to capture an API key or token from a service owner.
- An attacker uses public conference attendance, LinkedIn roles, or org charts to tailor a request that looks like a normal internal escalation.
- A fake notification imitates a cloud platform alert and tries to prompt an AI agent or admin workflow into executing a linked action without full verification.
- A targeted campaign mirrors language from an actual support case, which can be especially effective when stolen context is paired with stolen credentials, as seen in cases such as CoPhish OAuth Token Theft via Copilot Studio.
Because these lures depend on believable details, teams should treat public metadata, brand signals, and business process language as attack surface, not just marketing material. Standards-based identity controls from NIST Cybersecurity Framework 2.0 remain relevant here, especially where human approval or service-account use is involved.
Why It Matters in NHI Security
Context-rich phishing is dangerous in NHI environments because the first thing it often steals is not a password but trust in a workflow, a service account, or a delegated action path. Once a user or agent approves a request, attackers may pivot into secrets, tokens, certificates, or privileged automation. NHI Mgmt Group research shows that only 5.7% of organisations have full visibility into their service accounts, and 79% have experienced secrets leaks, with 77% of those incidents causing tangible damage. That combination makes context-driven lures especially effective when identities are already under-monitored.
This is also why zero trust and identity governance matter. If a message can convincingly imitate an internal request, then the defender needs verification that is independent of the message itself. The Ultimate Guide to NHIs is useful for connecting lure resistance to lifecycle controls, visibility, and rotation, while incidents like the Poland Military Breach show how context can amplify compromise when trust is misplaced.
Organisations typically encounter the operational cost of context-rich phishing only after a convincing message has triggered approval, token exposure, or an agentic action, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Context-rich phishing often targets agent approval paths and tool execution. |
| OWASP Non-Human Identity Top 10 | NHI-06 | Phishing is often the entry point to steal or misuse NHI credentials and tokens. |
| NIST CSF 2.0 | PR.AT-1 | Security awareness and training address recognition of socially engineered messages. |
| NIST Zero Trust (SP 800-207) | AC-3 | Zero trust reduces reliance on message context as a basis for access decisions. |
| NIST SP 800-63 | IAL2 | Identity assurance principles help validate who is really requesting an action. |
Harden NHI approval flows and monitor for context-based social engineering of identities.
