TL;DR: A luxury retailer’s image-heavy sales workflow was disrupted when a legacy email gateway blocked photos while still missing a supplier-compromise phishing campaign that used PNG lures and Microsoft 365 credential theft, according to Proofpoint. The case shows that blunt filtering and mailbox-era controls can break revenue-critical communication while leaving human-targeted attack paths open.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Proofpoint's blog post: In one retail case, image-blocking email security broke a sales workflow while still missing a supplier-compromise phishing campaign delivered through PNG lures.
Why it matters: It matters because email security controls that ignore business workflows can create operational damage while leaving human-targeted phishing paths open.
Context
Legacy email gateways were built to filter obvious malicious messages, not to manage modern communications that mix images, links, cloud workflows, and trust in third parties. When a security control treats images as suspicious by default, it can break legitimate business processes while still missing the real attack path. In this case, the business dependency on image sharing was not exceptional, it was central to daily operations.
The identity and governance angle is that this was not just an email filtering problem. A trusted supplier account was used to reach employees, which means the attack relied on delegated trust, human trust, and weak detection of image-based lures in Microsoft 365. For IAM and security teams, that makes the issue one of access trust boundaries as much as message security.
Key questions
Q: What fails when email security blocks images that business teams depend on?
A: The failure is operational, not just technical. If a sales or logistics process depends on photos, invoices, or image-based documents, blunt blocking can interrupt revenue, reconciliation, and customer service while doing little to stop phishing that uses different delivery techniques. Security teams should measure control impact against real workflows, not just malware detection rates.
Q: Why do supplier-compromise phishing campaigns create such a high trust risk?
A: They use an already trusted sender relationship to bypass suspicion and land in a workflow that feels routine. That matters because users are more likely to open, click, or respond when the message matches an expected business process. The risk comes from inherited trust, so third-party access governance and message scrutiny need to be aligned.
Q: What are the signs that an email control strategy is failing?
A: Look for two signals at once: business teams start working around email security by moving to consumer apps, and phishing still reaches users through unusual file types or trusted partner accounts. When both happen together, the control is neither protecting users nor supporting operations. That is usually a sign the policy model is too blunt for modern communication.
Q: How should teams respond when a phishing lure targets Microsoft 365 credentials?
A: Treat it as an identity exposure event, not only a mail incident. Review affected accounts, active sessions, recent sign-ins, and mailbox rules, then validate whether the lure reached other users through the same trusted path. The goal is to contain account abuse before it spreads into mailbox access, impersonation, or downstream business process disruption.
Technical breakdown
Why image-based phishing defeats mailbox-era filtering
Legacy secure email gateways were designed around attachment signatures, spam patterns, and coarse file-type rules. That model struggles when malicious content is embedded inside images, PDFs, or cloud-hosted workflows that look ordinary to older inspection engines. In this article, the problematic lure was a PNG image that led to a Microsoft 365 phishing page, which is a good example of how attackers now hide intent inside business-friendly file formats. The control gap is not only detection depth. It is also the inability to distinguish malicious image payloads from legitimate image-driven business communication.
Practical implication: teams need content inspection that understands embedded lures, not just file extensions or simple blocks.
How supplier compromise turns email into a trust channel
When attackers compromise a trusted third-party account, they inherit the sender reputation and relationship history attached to that account. That lets them bypass some user suspicion and deliver phishing that looks operationally normal. In this case, the supplier compromise was the entry point, and the retailer’s employees received a message that appeared to fit their working context. This is why business email compromise and supplier abuse are so effective. They exploit trust already granted in the communication chain rather than forcing a fresh technical compromise at every step.
Practical implication: monitor third-party access and supplier-originated email as a governance problem, not just a spam problem.
Why API-only remediation helps, but does not replace layered email defense
An API-based email security layer can rapidly scan existing mailbox traffic, detect malicious links, and recover business workflows without rerouting all mail through a legacy gateway. That is useful for fast containment and operational recovery. But API-only protection usually works after delivery or close to it, so it does not fully eliminate exposure to malicious content entering the inbox. The stronger model is layered: pre-delivery controls for prevention, plus API-based inspection for visibility and remediation. The article’s value is in showing that speed of deployment and depth of prevention solve different problems.
Practical implication: use API inspection for rapid recovery, but keep pre-delivery controls for inbox-level prevention.
Threat narrative
Attacker objective: The attackers wanted to turn a supplier compromise into employee credential theft and broader account access.
- Entry occurred through a trusted third-party supplier account that attackers had already compromised, giving them a believable delivery path into the retailer's email environment.
- The attackers used a PNG image lure to lead employees to a Microsoft 365 phishing page, which let them harvest credentials from users who trusted the message context.
- Several accounts were compromised before containment, showing that image-based phishing can translate a supplier breach into direct account takeover.
- The objective was to steal Microsoft 365 credentials and use that access to expand compromise inside the retailer's communication and operational workflows.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Legacy email gateways create a governance mismatch when business communication depends on images. The problem is not simply that older filters miss modern lures. It is that the control assumes image traffic is disposable, while the business depends on it for revenue generation, supply chain coordination, and customer interaction. Security architecture that cannot distinguish between risk-bearing images and operational images will eventually force business users to work around it.
Supplier trust is now part of the email security perimeter. A compromised third-party account can transform normal partner communication into an attack channel without triggering the kind of suspicion users associate with unknown senders. That means email security, third-party risk management, and identity governance now overlap more tightly than many organisations admit. The control failure is trust inheritance without sufficient verification.
Image-based phishing is a content problem and an identity problem at the same time. The message payload carried the lure, but the real control gap was the absence of strong handling for delegated trust, user credential exposure, and Microsoft 365 access paths. In practical terms, organisations that treat phishing only as a mail hygiene issue will miss the identity risk hidden inside the message.
Fast remediation beats architecture purity when operations are already disrupted. The article shows why API-based inspection can be an effective tactical bridge when legacy controls break business workflows. But the long-term lesson is not to choose convenience over prevention. It is to design email security so that operational continuity, malicious content inspection, and trust-boundary control can coexist.
Image-driven workflows need a new control concept: communication-aware inspection. The right question is not whether to block images, but whether the security stack can inspect them without breaking the business process they support. That framing is more useful for identity and email governance teams than treating image filtering as a binary allow-or-deny decision.
What this signals
Communication-aware inspection is the better model for image-heavy workflows. Organisations should stop treating all images as either safe or unsafe and instead align mail security with the business processes that use those images. That shift matters because revenue teams, logistics teams, and support teams often depend on content formats that legacy gateways were never designed to understand.
The broader governance signal is that email security, third-party risk, and identity controls now intersect at the trust boundary. If a supplier account can be used to deliver a believable lure, then message filtering alone is not enough; organisations need to inspect who is trusted, how that trust is granted, and what happens when it is abused.
For practitioners
- Map image-dependent workflows before changing email controls Inventory where sales, supply chain, billing, and customer service rely on images, because those paths will fail if security policy treats all image traffic as hostile.
- Treat supplier-originated email as high-trust, high-scrutiny traffic Apply enhanced review and phishing detection to messages from third parties whose accounts could be abused to impersonate legitimate workflows.
- Use layered mail inspection instead of blunt file blocking Prefer controls that inspect message content, links, and attachments while preserving business-critical file types rather than stripping PNGs or JPEGs indiscriminately.
- Prioritise identity containment after suspicious clicks Assume any credential submission from image-based lures may expose Microsoft 365 access, then review accounts, sessions, and recent mailbox activity immediately.
Key takeaways
- Legacy email gateways can break legitimate image-based workflows while still missing phishing that uses trusted suppliers and disguised lures.
- The core evidence is a retailer case where a supplier-compromise campaign used a PNG lure and Microsoft 365 phishing to compromise accounts.
- Security teams should align mail controls with business communication patterns, then contain identity exposure quickly when suspicious clicks occur.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article centres on supplier-enabled phishing that led to credential theft and account compromise. |
| Recommendation — Map the campaign to TA0006 and TA0008, then prioritise detection around credential theft and follow-on account use. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Trusted supplier access and resulting account compromise are governed by authorisation and access boundary controls. |
| Recommendation — Review access permissions that let third-party trust become a delivery path for phishing and account abuse. | ||
| CIS Controls v8 | CIS-5 — Account Management | Compromised accounts and mailbox access are central to the article's impact path. |
| Recommendation — Strengthen account management so compromised identities can be detected and contained faster. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | The incident culminated in Microsoft 365 credential theft through a phishing page. |
| Recommendation — Treat stolen credentials as broken authentication and validate mailbox access controls accordingly. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential theft and compromised accounts point directly to authenticator lifecycle governance. |
| Recommendation — Apply authenticator management to reduce the impact of stolen Microsoft 365 credentials. | ||
Key terms
- Secure Email Gateway: A secure email gateway is a control layer that inspects email before it reaches users and can also inspect outbound mail. It filters malicious content, enforces policy, and reduces exposure to phishing, malware, and data leakage, but it does not replace identity governance or account monitoring.
- Vendor Compromise: Vendor compromise is the abuse of a trusted third party's identity, account, or communication channel to reach a target organisation. It is especially dangerous because the message inherits real business context and can bypass suspicion that would stop an unknown sender.
- Image-based Phishing: Image-based phishing is a social engineering technique that hides malicious intent in images or image-linked workflows instead of obvious text-based scams. It can bypass older filters and push victims toward credential theft pages that look ordinary once the image is clicked.
- Message Authentication Code: A Message Authentication Code is a short cryptographic tag that proves a message has not been altered and was created by someone who knows the shared secret key. It is used in secure communication to detect tampering and authenticate the sender, but it does not provide encryption on its own.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management in the context of modern security programmes. It is useful for practitioners who need to connect identity controls to real operational risk across teams and workflows.
Published by the NHIMG editorial team on July 14, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org