Non-email phishing is expanding the identity attack surface

At a glance

What this is: This is an analysis of how phishing now reaches users outside email and turns a single compromised login into access across connected apps.

Why it matters: It matters because IAM and security teams can no longer treat phishing as a mailbox problem when identity compromise now spans SaaS, SSO and user interaction in multiple channels.

By the numbers:

• 60%+ of creds found in infostealer logs were from social media sites, according to the latest Verizon DBIR cited by Push Security.

Context

Phishing is now an identity-layer problem rather than an email-only problem. Attackers are using social media, instant messaging, SMS, search ads and in-app messaging to reach users directly, which weakens the assumption that email security is the primary choke point for malicious links.

The governance gap is that most enterprise controls were built around mailbox inspection, sender reputation and user-reported messages. When the lure arrives outside email, teams often lose message visibility, replay protection and centralised quarantine, so compromise is handled after the fact instead of at the point of identity interaction.

Key questions

Q: How should security teams defend against phishing when attacks move beyond email?

A: Security teams should shift from inbox-centric prevention to browser-aware detection, stronger app-consent governance, and post-login monitoring. Non-email phishing often bypasses sender controls entirely, so the browser becomes the key enforcement point. Teams also need identity telemetry that can identify session theft, malicious redirects, and risky OAuth grants after the lure succeeds.

Q: Why do non-email phishing campaigns increase enterprise risk?

A: They increase risk because they bypass the controls most organisations built around email, while still targeting the same identities and the same SSO-connected applications. That creates more entry paths, less visibility, and a wider blast radius when one account or session is compromised.

Q: What are the signs that phishing controls are failing in the browser rather than in the email gateway?

A: A common sign is when suspicious messages are blocked but users still reach realistic-looking login pages and enter credentials. Another signal is when campaigns keep working after a site is already known, because deny-lists update too slowly. If attackers are using CAPTCHA, fake overlays, or cloned interfaces to bypass user judgment, browser-layer controls are not keeping pace.

Q: What should teams do when a single identity provider account is compromised?

A: Assume the issue is broader than the first login and review the SSO-connected estate, active sessions and shared trust paths immediately. The goal is to contain downstream app access, not just reset the initial account, because the same identity may already unlock several business systems.

Technical breakdown

Why non-email phishing defeats mailbox-centric controls

Modern phishing kits exploit delivery channels that sit outside email filtering and user-reporting workflows. Once the lure is delivered through messaging apps, social platforms or malvertising, the defender no longer has a single system of record for detection, quarantine or campaign correlation. Attackers also use conditional loading, obfuscation and client-side rendering to make the malicious page look different from what a proxy or static scanner expects. The result is that detection has to move closer to the browser session, where the page is actually assembled and rendered.

Practical implication: expand detection to the browser and identity layer instead of relying on mailbox telemetry.

How attacker-in-the-middle phishing turns a login into session theft

Attacker-in-the-middle, or AitM, phishing proxies the victim’s interaction with a real-looking login flow and then captures the authenticated session rather than just the password. That matters because modern cloud access often depends on session tokens, not repeated password entry. The article’s examples show custom landing pages, legitimate hosting services and cloned sign-in screens being chained together to hide the final credential capture point. Once the token is stolen, the attacker can reuse the session without needing to replay the password.

Practical implication: treat session-token theft as a first-class identity control problem, not just a password problem.

Why one compromised account can become organisation-wide access

Phishing against Microsoft, Google or Okta is valuable because those identities often sit at the centre of SSO. If one account is compromised, the attacker can pivot into connected applications, internal messaging and downstream business systems that trust the same identity provider. This is why the blast radius is much larger than the initial login page. The identity layer becomes the multiplier: a single authenticated session can be used to approach other users, abuse trust signals and move from one app to many.

Practical implication: map SSO-connected app dependencies and treat identity provider compromise as a business-wide exposure event.

Threat narrative

Attacker objective: The attacker wants to turn one user interaction into reusable identity access that can be expanded across cloud apps, collaboration tools and business systems.

1. Entry occurs through non-email delivery paths such as social media, instant messaging, malvertising or SaaS-delivered messages that bypass traditional email controls.
2. Credential harvesting happens through AitM pages, cloned login screens and conditional phishing flows that steal credentials or session tokens once the user interacts.
3. Escalation follows when the attacker reuses the stolen identity in SSO-connected apps and internal collaboration tools to reach more accounts and business systems.
4. Impact is broad account compromise, with the victim’s trusted identity becoming a launch point for wider organisational access and further targeting.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Non-email phishing is now an identity governance problem, not a mail security problem. The delivery channel has diversified, but the real control failure is that many programmes still anchor phishing defence to inbox telemetry and sender reputation. When the lure arrives through social media, search ads or in-app messaging, the governance model loses sight of the interaction before identity is touched. Practitioners need to stop treating email as the boundary of phishing risk.

Identity provider compromise is the blast-radius multiplier in modern phishing. The article shows how compromise of Microsoft, Google or Okta credentials can extend through SSO into connected SaaS and internal collaboration tools. That means one successful phish is not an endpoint event, it is a federation event with downstream access consequences. IAM teams should assess which applications inherit trust from a single identity provider and how quickly that trust can be abused.

Session theft has become more operationally important than password capture. AitM phishing, browser token theft and cloned sign-in pages shift the attack from secret discovery to session reuse. This is where conventional password-centric controls become weaker than browser-session controls. The practical lesson is that identity assurance now depends on what happens after authentication, not only on how the user logged in.

Cross-channel phishing creates a visibility gap that traditional detections do not close. When phishing moves into social platforms and search ads, organisations lose the familiar signals that email security platforms provide, including message headers, sender lineage and bulk campaign visibility. That gap is not just technical. It changes the governance burden for detection, because the organisation must infer phishing from page behaviour, browser interaction and identity anomalies rather than from the message itself.

Ephemeral delivery does not reduce identity debt. Even when malicious URLs are quickly rotated or blocked, the identity compromise can persist through tokens, saved credentials and trusted SSO sessions. This creates a wider trust debt than the delivery channel alone suggests. Practitioners should treat post-authentication privilege reach as part of phishing risk, not as a separate problem.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Non-email phishing forces identity teams to move detection closer to the browser session. Email filtering still matters, but it no longer provides enough context when lures arrive through search, social and messaging channels. The programme question is whether identity and browser telemetry are already joined well enough to catch the interaction before the session is established.

Identity provider trust is the real prize in these campaigns. Once attackers land on a federated account, the risk is not limited to that login. It extends into every SaaS application and collaboration channel that reuses the same trust relationship, which means blast-radius mapping is now a core IAM activity.

Ephemeral phish delivery does not mean ephemeral impact. Domain rotation and camouflage tactics may shorten the life of the lure, but stolen sessions, saved credentials and linked accounts can keep the compromise alive. Teams should judge phishing resilience by how quickly they can contain identity reuse, not by how quickly a URL disappears.

For practitioners

• Broaden phishing detection beyond email Instrument browser and identity telemetry so malicious pages can be detected as users load and interact with them, even when the lure never enters the mailbox.
• Map SSO blast radius Inventory which cloud and SaaS applications trust the same identity provider, then identify where a single account takeover would expose high-value systems.
• Harden against session theft Prioritise controls that can detect token replay, suspicious browser session activity and attacker-in-the-middle login flows, not just password misuse.
• Review personal account crossover on corporate devices Check where personal profiles, messaging apps and browser sync can move credentials or session data from a work device into an attacker’s hands.
• Correlate non-email campaigns across channels Use incident handling processes that connect social media, search and messaging-based lures back to a single campaign when the same attacker rotates delivery paths.

Key takeaways

• Phishing has expanded beyond email, so mailbox-centric controls no longer cover the full identity attack surface.
• The important failure is not just delivery but the ability of one stolen identity to reach many connected applications through SSO.
• Defence now depends on browser-level detection, identity telemetry and tighter visibility into downstream trust relationships.

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Non-email phishing: Non-email phishing is credential theft delivered through channels outside the corporate mailbox, such as social platforms, messaging apps, search results, or in-app communications. It matters because many organisations still concentrate anti-phishing controls on email while leaving these adjacent channels under-monitored.
• Session Token Exposure: Session token exposure occurs when authentication tokens or session artifacts are stored, transmitted, or logged in places they should not be. Once exposed, they can function like reusable credentials. This makes them part of identity and access risk, not only application behaviour.
• SSO blast radius: The amount of downstream access created when one identity provider account is compromised. In practice, it measures how far a single successful phish can travel through connected applications, and it often determines whether an incident stays local or becomes enterprise-wide.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.