Email-borne malware still drives most attacks and ransomware loss

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Email still drives most malware entry, and modern ransomware tactics are outpacing legacy inbox controls.

Why it matters: IAM and security teams need to treat email as a governance and trust problem, because a single compromised inbox can become the entry point for lateral movement across connected systems.

Context

Email remains the most common path into enterprise environments because it sits inside normal business operations, not outside them. That makes the control problem bigger than spam filtering or attachment inspection: the real issue is that attackers can borrow legitimate communication patterns to get users to act.

For identity and access programmes, the risk is not only the inbox compromise itself but the downstream trust chain. Once a message convinces someone to click, download, or approve, the attacker may move into collaboration tools, cloud services, and adjacent accounts with far more reach than the original email suggests.

The article frames this as a legacy-control problem. Secure email gateways and sandboxes were built to spot static indicators, but the current threat pattern relies on behavioural deception, AI-generated variants, and payload delivery methods that leave fewer traditional signatures behind.

Key questions

Q: What breaks when email security still relies on static signatures?

A: Static signatures fail when attackers rotate content, delay delivery, or move execution into memory. The result is a control gap, not just a detection miss: malicious messages can look harmless at scan time and still trigger compromise later in the workflow. Organisations need behavioural and contextual analysis, not only file and link inspection.

Q: Why do email-based malware attacks lead to wider business disruption?

A: Because email is tied to identity, approvals, and collaboration systems. Once a mailbox or message path is trusted, attackers can pivot into adjacent tools, capture credentials, trigger session abuse, or influence business decisions. The impact is broader than one inbox because the mailbox often sits inside a larger access chain.

Q: How do organisations know if email security is actually working?

A: Look for fewer fraudulent requests reaching approval stages, faster triage of suspicious mail, and reduced analyst time spent on low-value noise. Effective email security improves decision quality, not just blocking rates, because the real test is whether risky identity-linked messages are stopped before business action occurs.

Q: What should organisations do after email malware reaches connected systems?

A: Contain the compromised identity first, then revoke or reissue affected sessions, tokens, and privileges before the attacker can pivot further. The response should also trace which collaboration and cloud tools were reachable from the inbox so the blast radius can be narrowed quickly.

Technical breakdown

Why email malware now beats signature-based controls

Signature-based email security looks for known bad indicators such as malicious attachments, URLs, hashes, or repeatable payload patterns. That works poorly when attackers use AI to generate endless code variants, vary tone and timing, or hide payloads behind delayed redirects and in-memory execution. In those cases, the malicious content may never present the same static fingerprint twice. The technical shift is from content matching to behaviour and context. Defenders need to understand not just what a message contains, but how it fits the sender’s normal communication patterns and the user’s expected workflow.

Practical implication: stop treating static indicators as sufficient evidence of safety and build detection around behavioural anomalies.

How one inbox compromise becomes lateral movement

Email is dangerous because it is embedded in identity and collaboration systems. A successful phishing or malware delivery event can expose credentials, trigger session theft, or simply persuade a user to authorise access in a connected tool. From there, the attacker can pivot into cloud apps, file-sharing platforms, chat systems, or business workflows that trust the compromised identity. The article’s point is that the inbox is not an isolated channel. It is often the first trusted hop in a wider access chain, which is why compromise frequently spreads well beyond the email platform itself.

Practical implication: map email compromise paths to downstream entitlements in collaboration and cloud platforms, not just to mailbox cleanup.

Why in-memory payloads and delayed redirects evade legacy inspection

Legacy secure email gateways and sandboxes often depend on detonating files or following links in a controlled environment. Malware authors now avoid those assumptions. In-memory malware leaves little or no file artifact to inspect, while delayed redirects can appear harmless at delivery time and only resolve after the original scan window has passed. AI-generated variants further reduce reuse, so a sandboxed sample may not match the next wave. This makes the gap structural rather than merely operational: controls that rely on a fixed inspection moment miss threats designed to move outside that moment.

Practical implication: extend inspection beyond the initial message event and add detection for delayed or behaviour-based activation patterns.

Threat narrative

Attacker objective: The attacker wants to turn a trusted email interaction into broader access, then use that access to deploy malware, extort money, or spread laterally across connected systems.

1. Entry begins with a convincing email that uses familiar business context to prompt a click, download, or credential submission.
2. Credential access or payload delivery follows through a malicious attachment, fake portal, in-memory code, or delayed redirect that avoids static inspection.
3. Escalation occurs when the compromised inbox or captured credentials are used to pivot into connected cloud and collaboration tools.
4. Impact is enterprise-wide disruption, including ransomware execution, operational downtime, and broader trust erosion across the business.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Email remains a trust-plane problem, not just a content-filtering problem. The article shows that attackers win by exploiting legitimate communication habits, not simply by dropping malicious files into inboxes. That means email security has to be evaluated as part of identity trust and workflow governance, not as a standalone malware box-ticking exercise. Practitioners should treat message credibility, user context, and downstream access as one control surface.

Legacy inspection models are breaking because they assume malicious intent is visible at scan time. In-memory payloads, delayed redirects, and AI-generated variants all violate that assumption. Static controls can still reduce noise, but they no longer define the boundary between safe and unsafe email. The practical conclusion is that organisations need controls that reason over behaviour and context, not just static indicators.

Identity blast radius is now the more important risk metric than initial inbox compromise. The article’s most important point is that one mailbox can become the entry point into cloud, collaboration, and business systems with far larger impact. That expands the governance question from phishing prevention to privilege containment across connected tools. Practitioners should measure how far a compromised mailbox can move before detection or revocation.

Behavioural detection is becoming the new baseline for email defence. The article supports a shift toward tools that learn normal sender, recipient, and workflow patterns, then flag unusual timing, tone, account changes, or domain shifts. That is not a replacement for traditional controls, but it is the layer that handles modern evasion. Security teams should align email defence with identity-aware anomaly detection rather than static signature dependence.

What this signals

Identity-aware email defence is becoming the practical baseline. The next control question is not whether a message looks malicious in isolation, but whether it fits expected identity, timing, and workflow behaviour. That shifts email protection from static filtering toward access-aware anomaly detection across the tools that consume the message.

Email compromise now needs to be measured by downstream reach. Security leaders should care less about blocked spam volume and more about how far a compromised inbox can travel before revocation, especially across collaboration platforms and cloud services. That metric better reflects business exposure than mailbox telemetry alone.

For practitioners

• Harden inbox trust decisions Correlate sender identity, message timing, domain reputation, and user context before allowing high-risk actions such as payment changes or credential entry.
• Reduce lateral movement from email compromise Map the applications and sessions that a compromised mailbox can reach, then restrict token reuse and high-value workflow approvals across those systems.
• Replace static-only detection assumptions Tune controls to flag delayed redirects, in-memory execution patterns, and AI-generated message variation instead of relying only on file and URL signatures.
• Prioritise recovery around trust impact Build incident playbooks that account for customer trust erosion, not just mailbox cleanup and malware removal, because reputational damage can outlast technical remediation.

Key takeaways

• Email remains a primary malware entry point because attackers exploit trust inside normal business communication, not just technical flaws.
• The article shows that legacy controls miss modern threats when payloads are in memory, redirected later, or generated dynamically to avoid signatures.
• Practitioners need behavioural detection and tighter downstream access containment because a single inbox compromise can spread far beyond email.

Key terms

• Email-borne malware: Malware delivered through email rather than through a direct software exploit. It often relies on trust, routine work, and user action to begin execution, then uses the mailbox as the first step into broader systems and workflows.
• Behavioral Detection: A monitoring approach that looks for unusual activity rather than relying only on static inventories. For SaaS integrations, it detects drift in token use, data movement, timing, and endpoint behavior so teams can spot compromise, misuse, or automation that no longer matches its expected pattern.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.