Multichannel phishing and account takeover are redefining human risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Proofpoint's blog post: Phishing is spreading across collaboration, messaging and social channels, making account takeover and impersonation attacks harder to contain with email-only controls.

Why it matters: IAM, PAM and security awareness teams need to treat every trusted communication channel as an identity attack surface, because account compromise now travels through people as much as through systems.

By the numbers:

• 99% of the organizations Proofpoint monitors are regularly targeted for account takeovers.

Context

Phishing is no longer confined to inbox defence. The security problem is the widening trust boundary: attackers now use collaboration tools, social platforms and messaging apps to reach users where identity signals are weaker and verification habits are inconsistent.

That shift matters because account takeover is an identity control failure before it becomes a fraud or malware event. When a message looks routine inside a trusted channel, employees are more likely to treat it as legitimate, which makes human judgement part of the attack path rather than the last line of defence.

Key questions

Q: What breaks when phishing moves beyond email into collaboration apps?

A: Email-only defence breaks because the attacker no longer needs to win inside the mailbox. They can exploit trust in chat, social or file-sharing channels where users are less primed for scrutiny and where identity cues are weaker. Teams need verification, reporting and monitoring that follow the user across channels, not just the inbox.

Q: Why do compromised supplier accounts create such high fraud risk in BEC attacks?

A: Compromised supplier accounts are dangerous because they inherit trust from an otherwise legitimate relationship. Attackers can insert themselves into real invoice threads, change payment instructions, and appear credible enough to bypass normal scrutiny. In manufacturing and other supply chain environments, that trust can be enough to redirect funds, disrupt operations, and turn a routine business process into financial fraud.

Q: What are the signs that multichannel phishing is succeeding?

A: Watch for unusual requests arriving from familiar contacts, sudden changes to payment details, unexpected urgency, and messages that shift between channels to keep pressure high. Repeated account takeover attempts, odd login patterns and conversations that do not fit established business routines are also strong indicators.

Q: How should organisations govern supplier communications and payment changes?

A: They should require independent verification before any sensitive request enters a workflow, especially when money, credentials or confidential data are involved. That means separating request intake from approval, documenting trusted callback paths, and making exception handling visible to finance and security teams.

Technical breakdown

Why multichannel phishing bypasses email-centric controls

Email security controls are built around message inspection, domain reputation, and link analysis inside a single channel. Multichannel phishing weakens that model by moving the lure into tools such as Slack, Teams, Zoom, LinkedIn and WhatsApp, where the same policy stack may not exist or is not tuned for business impersonation. The attacker does not need to beat every control; they only need one trusted channel where the user accepts the interaction as normal. That turns platform trust into an attack primitive. In practice, the security boundary shifts from mail gateways to identity-aware verification across every user interaction surface.

Practical implication: extend detection and user verification beyond email to the collaboration and messaging tools where trust is now being exploited.

How account takeover enables multistage fraud

Account takeover is not just access to a mailbox or chat thread. Once an attacker controls an account, they can establish credibility, observe internal workflows, and use the compromised identity to request payments, collect data, or stage follow-on compromise. That is why account takeover often becomes a launch point for business email compromise, supplier fraud, and broader social engineering. The abuse is especially effective when the attacker can reply from a real account, mirror the sender's tone, and time requests to match business routines. The identity of the sender becomes the payload.

Practical implication: treat any compromised user or supplier account as a fraud-enablement event, not only as a mailbox security issue.

Why supplier impersonation is a governance problem

Supplier fraud succeeds when organisations trust relationship context more than message provenance. Attackers impersonate vendors, payment contacts, or third parties to bypass normal caution and push urgent changes to banking details or approval paths. The governance gap is that many organisations verify the sender too late, after a request has already entered a workflow designed for speed. This is an identity verification problem as much as an awareness problem, because the organisation is being asked to trust a communication channel without strong proof of who is behind it. Verification must happen before the request is accepted into process.

Practical implication: require out-of-band verification for payment changes, sensitive requests and unusual supplier communications before they enter the workflow.

Threat narrative

Attacker objective: The attacker wants to convert trusted human communication into durable account control that can be used for fraud, data theft or deeper compromise.

1. Attackers begin with multichannel delivery, placing phishing lures in collaboration, messaging, social and cloud-sharing channels that users already trust.
2. They harvest credentials or capture account access through weak authentication, deceptive links or social engineering, then use the compromised identity to impersonate a real person or supplier.
3. With account control, they deepen their foothold through business email compromise, data theft, fraud or other follow-on abuse that leverages trusted communications.
4. The end state is financial loss, data exfiltration, reputational damage or ransomware staging from a legitimate-looking account.

Breaches seen in the wild

• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Multichannel phishing is an identity governance problem, not just a message-security problem. Once attackers move across collaboration tools, social channels and messaging apps, the trust boundary is no longer owned by the email gateway. Security teams need to treat identity verification and user behaviour as control points across every communication path, not as awareness add-ons.

Account takeover now functions as a fraud platform. A compromised user or supplier account gives attackers believable context, internal timing and workflow knowledge. That changes the risk from isolated phishing to staged abuse, where the account itself becomes the delivery mechanism for BEC, supplier fraud and data theft.

Human judgement has become a security control with measurable failure modes. Proofpoint's figures on risky behaviour and account takeover targeting show that users are still being targeted at scale, but the governance question is where the verification step sits. If a workflow accepts identity claims without out-of-band confirmation, it is already assuming the attacker will fail to blend in.

Supplier trust needs a named control concept: verification trust gap. The gap appears when organisations trust a familiar sender or channel more than the proof behind the request. That is where impersonation, payment redirection and urgent approval abuse succeed, so practitioners should redesign approval paths around verified origin rather than conversational familiarity.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: Service Account Security Guide

What this signals

Multichannel phishing widens the human attack surface. Security programmes that still centre on inbox controls are now protecting only one part of the trust path. The better model is to align awareness, verification and detection around the channels where employees actually decide whether a request is legitimate.

Verification trust gap: the new weak point in supplier and BEC defence. Attackers win when familiar names outrank proof of origin. Organisations should hardwire out-of-band confirmation into payment and access workflows, because channel familiarity is not identity assurance.

People act across many channels, and account takeover attempts are common enough to justify programme-level controls, with 99% of the organizations Proofpoint monitors regularly targeted for account takeovers according to the State of Secrets Sprawl 2026.

For practitioners

• Broaden phishing detection across collaboration channels Extend monitoring, user reporting and simulated phishing coverage beyond email into Teams, Slack, Zoom, LinkedIn and WhatsApp, because the lure now arrives where inbox controls are absent or weaker.
• Require out-of-band verification for payment changes Create a mandatory callback or second-channel check for supplier banking changes, unusual invoices and urgent approval requests before they are accepted into workflow.
• Treat account takeover as a fraud incident When a user or supplier account is compromised, reset trust on that identity, review recent conversations and block any payment, file access or approval requests sent from the account.
• Train users to challenge familiar-looking requests Focus awareness content on impersonation, urgency and cross-channel consistency checks so employees verify requests even when the sender, tone and timing look routine.

Key takeaways

• Phishing now succeeds by exploiting trusted channels, not just by bypassing email filters.
• Account takeover turns a user or supplier identity into a fraud and access vehicle.
• Out-of-band verification is the control that most directly limits impersonation-driven approval abuse.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Supplier Fraud: Supplier fraud is the misuse of a trusted third-party relationship to redirect payments, change account details or obtain sensitive information. It exploits verification gaps between a request arriving and a request being approved, especially when staff assume familiarity equals legitimacy.
• Multichannel Phishing: Multichannel phishing is social engineering delivered across email, chat, social media, SMS, or collaboration tools instead of one inbox. The attacker uses whatever channel feels most familiar to the victim, which makes the request harder to scrutinise and increases the chance of credential theft, approval abuse, or fraudulent payment.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management and workload identity for practitioners responsible for modern access control. It helps security and identity teams connect identity governance to the operational controls that limit credential abuse and impersonation.