TL;DR: Malicious emails now use URLs four times more often than attachments, while attackers increasingly hide payloads behind authentication pages, scanner-detection logic, and trusted collaboration workflows, according to Proofpoint’s Human Factor Report Vol. 2. The control gap is no longer message filtering alone, but continuous inspection across the full user journey.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Proofpoint's blog post: Phishing is evading email gateways by hiding behind authentication barriers, detecting sandboxes, and abusing trusted collaboration workflows.
Why it matters: It matters because IAM and security teams cannot treat email filtering as a complete control when attackers shift trust abuse into user authentication, browser interaction, and collaboration platforms.
Context
Email security often assumes a message can be judged safely before a user acts on it. That assumption breaks when the malicious part of a campaign only appears after authentication, when a link responds differently to automation, or when the threat is delivered through a trusted collaboration system instead of the email channel itself.
For IAM and identity-adjacent teams, the important shift is that trust is now being tested at the point of interaction rather than at delivery time. The article is less about mail filtering and more about how attackers exploit legitimate login flows, sanctioned collaboration tools, and user expectations to move phishing outside the scope of a gateway-only model.
The subject's starting position is increasingly typical in modern enterprise environments, not exceptional.
Key questions
Q: What breaks when phishing is hidden behind authentication pages or sandbox checks?
A: Email-only inspection breaks because the malicious destination is not visible until after the user authenticates or the page behaves differently in a real browser. Security teams need controls that evaluate the rendered session, not just the first URL response, or they will keep approving content that becomes dangerous only after interaction.
Q: Why do trusted collaboration channels increase phishing risk?
A: Trusted collaboration channels increase risk because users apply relationship context before they apply security skepticism. When a familiar sender posts in an active channel, the message inherits credibility and can bypass the hesitation that usually protects against obvious phishing. That trust gap turns the collaboration layer into an attack surface.
Q: How should security teams detect URLs that behave differently for sandboxes and real users?
A: They should combine browser-level inspection with behavioural telemetry such as redirects, user-agent patterns, JavaScript execution, and navigation context. If a page is safe only when it suspects a sandbox, that is itself a signal that the control model needs to move beyond single-pass URL analysis.
Q: When should organisations move from email filtering to broader workflow protection?
A: They should make that shift as soon as phishing begins using authenticated links, collaboration apps, or application-layer delivery paths that do not depend on email transport. At that point, inbox controls are necessary but no longer sufficient, because the attack surface has expanded into the user workflow itself.
Technical breakdown
Why authentication walls break URL inspection
Email gateways and sandboxes typically inspect the first reachable page, not the full interaction chain behind it. If a malicious URL first resolves to a benign authentication page, CAPTCHA, or identity prompt, automated analysis may conclude the link is safe because the malicious payload is still hidden. The attack depends on the defender seeing only the pre-authentication surface while the real payload waits behind user interaction. This is a control boundary problem, not just a filtering problem, because the security decision is being made before the relevant content is exposed.
Practical implication: inspect time-of-click behaviour and post-authentication destinations, not just the initial URL response.
How sandbox mirages evade automated analysis
A sandbox works only if the target page does not recognise it as automated. Attackers can fingerprint user-agent strings, IP ranges, headers, JavaScript execution, and navigation patterns to decide whether to show a harmless page or the real lure. That means the same URL can present a safe façade to security tooling and a malicious payload to a human user. This is a detection-evasion pattern, and it creates a structural weakness in single-pass URL inspection because the analysis environment becomes part of the signal the attacker is filtering on.
Practical implication: add behavioural and browser-level inspection that can follow redirects and rendered content in real time.
Why collaboration platforms widen the phishing surface
Calendar systems and other collaboration tools can synchronise content directly between users without the email delivery path ever seeing a message. In the article's example, the threat is embedded in a calendar invitation draft and then propagated through the trusted application layer. That bypasses mail security controls entirely because the control point was placed on transport, not on the collaboration workflow. For identity teams, this matters because trust relationships between accounts, tenants, and applications can become an alternate delivery mechanism for phishing and malware.
Practical implication: extend inspection and policy enforcement into collaboration tools and application-layer sharing workflows.
Threat narrative
Attacker objective: The attacker wants to place a trusted-looking lure in front of the user, then collect credentials or deliver malware after automated inspection has already failed.
- Entry begins with a seemingly legitimate URL or collaboration invitation that reaches the target through a trusted channel and avoids initial suspicion.
- Credential access or payload exposure occurs only after the user authenticates, clicks through verification, or interacts with the content in a real browser session.
- Impact follows when the hidden destination delivers credential harvesting, malware, or phishing content that was never visible to the gateway or sandbox.
Breaches seen in the wild
- Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Phishing is moving from message inspection to interaction inspection. The core failure here is the assumption that scanning the message or first landing page is enough to judge risk. Once attackers hide malicious content behind authentication, conditional logic, or rendered browser behaviour, the control point shifts to the moment of user interaction. Practitioners should treat this as a governance problem in the full delivery chain, not just an email hygiene issue.
Trusted workflows now act as delivery infrastructure for phishing. The calendar example matters because it shows how sanctioned collaboration systems can become an alternative channel for malicious content without any traditional email event. That changes the scope of identity and access governance: trust between accounts, tenants, and applications becomes part of the threat surface. Security teams need policy coverage where users actually consume content, not only where mail arrives.
Sandbox-aware phishing is a detection-evasion pattern, not a single tactic. Detecting the detector, hiding behind authentication, and shifting into collaboration tools all serve the same purpose: to make the security stack see a harmless version of the attack. Workflow trust gap: this is the specific control failure the article exposes, and it is what browser-aware and collaboration-aware controls must address. The practitioner conclusion is clear: inspect trust relationships, not just messages.
Continuous analysis is the new baseline for phishing governance. Static verdicts at delivery time do not match how these campaigns operate. The more relevant control model is continuous re-evaluation across the user journey, including click time, post-click behaviour, and application-layer delivery paths. For identity and security teams, that means policy must follow the session and the workflow, not stop at the inbox.
Identity systems are being used as part of the lure. Authentication prompts, login pages, and legitimate file-sharing or calendar workflows are not just user-interface details. They are the mechanism attackers use to convert trust into access. Practitioners should therefore evaluate phishing controls as part of identity journey governance, because the abuse point increasingly sits between the inbox and the authenticated session.
What this signals
Workflow trust gap: phishing is now exploiting the space between delivery controls and user action, which means inspection has to follow the interaction rather than stop at the inbox. Security programmes that still centre on message filtering are missing where the attack actually lands.
The practical consequence for practitioners is a shift toward browser-aware and collaboration-aware controls that can see redirects, rendered content, and application-layer propagation. In identity terms, that means governance has to include the authentication moment and the trusted session, not just the mail gateway.
Phishing resilience is becoming a cross-domain control problem that spans email, browser behaviour, and sanctioned collaboration workflows. Teams that keep these domains separate will continue to inherit blind spots from each individual control layer.
For practitioners
- Inspect the full click journey Move from delivery-time verdicts to time-of-click and post-click inspection so the hidden destination is evaluated after redirects and authentication prompts are resolved.
- Extend controls into collaboration platforms Apply detection and policy enforcement to calendar invites, shared documents, and messaging workflows that can synchronise content without email transport.
- Harden identity prompts used in lures Review external login prompts, file-sharing sign-ins, and CAPTCHA flows so users can recognise when authentication is being used as part of phishing delivery.
- Correlate browser signals with email verdicts Feed user-agent, redirect, JavaScript, and navigation anomalies into detection logic so a page that behaves differently for scanners and users is treated as suspicious.
Key takeaways
- Phishing is increasingly designed to escape email gateways by hiding malicious content behind login prompts, sandbox checks, and collaboration workflows.
- The article's key evidence is that URLs now appear 4x more often than attachments in malicious emails, showing how threat actors are changing their delivery methods.
- Continuous inspection across the user journey, including click time and collaboration tools, is now more relevant than message filtering alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001; TA0006; TA0040 — Initial Access; Credential Access; Impact | The article centres on phishing entry, credential capture, and malicious payload delivery. |
| Recommendation — Map the campaign stages to ATT&CK and tune detections for credential harvest and payload delivery paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Trusted workflows and authentication prompts turn authorisation boundaries into the attack surface. |
| Recommendation — Apply PR.AA-05 to govern where user access and trust decisions are being reused as phishing lures. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Application-layer trust and sandbox-detection logic create misconfigured inspection boundaries. |
| Recommendation — Treat application-layer trust paths as security boundaries and remove assumptions that a single inspection point is sufficient. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Continuous analysis and post-delivery monitoring are central to countering evasion-based phishing. |
| Recommendation — Extend SI-4 monitoring to cover click-time and post-click behaviour across email and collaboration workflows. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Behavioural inspection depends on collecting usable telemetry from browsers and collaboration platforms. |
| Recommendation — Centralise logs and event data from mail, browser, and collaboration systems to detect evasion patterns. | ||
Key terms
- Email Gateway Bypass: A situation where malicious email slips past secure email gateway controls because the message does not trigger traditional indicators such as bad reputation, suspicious files, or malicious links. Modern bypasses often rely on trusted accounts, subtle social engineering, and content that looks ordinary enough to avoid pattern-based filtering.
- Sandbox Analysis: Sandbox analysis is the controlled execution of a suspicious file or URL in an isolated environment to observe behaviour safely. Security teams use it to capture file characteristics, runtime actions, and indicators of compromise without exposing production systems to the sample itself.
- Time-of-click protection: Time-of-click protection reevaluates a link when the user actually opens it, rather than only when the message first arrives. It helps catch URLs that are harmless at delivery but become malicious after redirects, authentication steps, or server-side conditions reveal the payload.
- Collaboration trust abuse: Collaboration trust abuse is the misuse of approved messaging or sharing relationships to deliver malicious content through a channel users already trust. In Teams-style environments, the danger is not only account compromise but also the way permitted communication can be turned into an attack path.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect access control decisions to the broader governance model their programmes depend on.
Published by the NHIMG editorial team on July 14, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org