Non-email phishing is expanding the identity attack surface

At a glance

What this is: This article argues that phishing now bypasses email controls by using social media, messaging apps, malvertising, and in-app channels to reach users directly.

Why it matters: It matters because IAM, NHI, and human identity teams can no longer treat email security as the primary phishing boundary when compromised accounts can cascade through SSO and connected apps.

By the numbers:

• According to the most recent Verizon DBIR, 60%+ of creds found in infostealer logs were from social media sites.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read Push Security's analysis of non-email phishing and identity compromise

Context

Non-email phishing is a delivery problem with identity consequences. Once attackers can reach users through social media, instant messaging, malicious ads, or in-app messages, the mailbox is no longer the main control point for stopping credential capture or session theft. For IAM teams, the issue is not just message filtering. It is whether identity controls still assume a single inbound channel and a single inspection layer.

The article shows how modern phishing campaigns exploit browser-based login flows, compromised social accounts, and SSO-connected apps to turn one successful lure into broader access. That shifts the governance question from 'can we block the message?' to 'can we contain the identity once the lure succeeds?' The answer increasingly depends on visibility across human accounts, session controls, and downstream application access.

Key questions

Q: How should security teams respond when phishing moves outside email channels?

A: They should move detection to the browser and identity layers, because the mailbox is no longer the only or even the main delivery path. Security teams need correlation across search ads, messaging apps, social channels, and SaaS login pages so they can detect the lure, not just the email. Containment should focus on session revocation and account review.

Q: Why do non-email phishing campaigns increase enterprise risk?

A: They increase risk because they bypass the controls most organisations built around email, while still targeting the same identities and the same SSO-connected applications. That creates more entry paths, less visibility, and a wider blast radius when one account or session is compromised.

Q: What do organisations get wrong about blocking phishing URLs?

A: They often assume URL blocking is enough after a report, but modern campaigns rotate domains quickly and selectively serve content to evade static controls. By the time one site is blocked, the attacker may have already shifted to another domain or another delivery channel entirely.

Q: How can teams reduce the impact of a stolen login session?

A: Teams should treat the session as the primary compromise object and build rapid revocation paths around it. That means continuous monitoring for anomalous browser activity, immediate token invalidation when risk is detected, and tighter access controls on identities that can reach many downstream apps.

Technical breakdown

Why phishing now bypasses email controls

Modern phishing is increasingly delivered through channels that email security never sees, including LinkedIn messages, chat apps, search ads, SMS, and embedded app messaging. Attackers also use attacker-in-the-middle kits, conditional loading, and obfuscation to make the page look legitimate while defeating proxy inspection. Once the lure is outside email, traditional quarantine, sender reputation, and mailbox rules lose their leverage because there is no central message stream to inspect or recall.

Practical implication: security teams need detection that follows the browser session, not only the email gateway.

How session theft turns a phish into identity compromise

The article’s key technical point is that many modern phishing pages are built to steal credentials and session tokens in real time. That matters because a valid session can bypass some authentication checkpoints even when a password is never reused. In SSO environments, a single compromised identity can then reach multiple downstream applications, which makes the browser session a high-value target rather than just the login form.

Practical implication: enforce stronger session controls and rapid revocation paths for suspicious authenticated activity.

Why SSO makes one compromised account broader than one app

Compromise of a core identity provider or a widely used SaaS login can extend far beyond the first application. Because many business apps inherit trust through SSO, attackers can move from a single user account into internal messaging, admin workflows, and connected cloud services. The blast radius is defined by trust relationships between applications, not by the original phish alone.

Practical implication: map SSO dependencies and treat high-trust accounts as lateral-movement entry points.

Threat narrative

Attacker objective: The attacker wants a trusted account or session that can be reused to enter enterprise systems, reach connected apps, and expand compromise beyond the initial lure.

1. Entry occurs through non-email channels such as social media, messaging apps, malvertising, or in-app messages that bypass mailbox controls and reach the user directly.
2. Credential or session capture happens when the victim lands on an attacker-in-the-middle login page or a cloned site that steals credentials, cookies, or live session tokens.
3. Impact follows when the attacker uses the compromised identity to access SSO-connected applications, internal messaging, or customer-facing systems and then pivots to additional targets.

Breaches seen in the wild

• New York Times breach — New York Times source code and credentials exposed via GitHub.
• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Non-email phishing has turned the browser into the real control plane of user compromise. Once attackers can reach victims outside email, the security model shifts from message hygiene to identity interception. Mailbox-only controls miss the page the user actually sees, which means the first meaningful security boundary is now the browser session and the identity interaction that follows. Practitioners should treat browser-layer visibility as a core control plane, not an enhancement.

SSO creates identity blast radius, not just convenience. A compromised login to a core identity provider can unlock dozens of connected applications without a second phishing event. That is the governance problem this article surfaces: authentication success in one place can mean implicit trust everywhere else. The implication is that identity architecture, not just user behaviour, determines how far a phish travels.

Conditional delivery and obfuscation are now standard evasion patterns, not edge cases. Modern phishing kits selectively serve content by device, location, referrer, or browser state, which breaks assumptions built around static URL reputation and domain blocking. The named concept here is context-aware phishing evasion: attackers tailor payload delivery to escape the controls that rely on a single, fixed view of the request. Practitioners should assume that URL blocking alone will remain a partial defence.

Account takeover is increasingly a cross-channel identity problem, not a single-user mistake. The social media, search, and messaging channels described here all depend on identity trust that sits outside the enterprise perimeter. That makes user education necessary but insufficient. The programme question is whether identity governance can see, correlate, and contain a compromise once it begins in a channel the enterprise does not own.

Identity security programmes must now correlate human access, browser activity, and downstream SaaS trust. This is where human IAM and NHI governance meet in practice. The same operational logic that governs machine trust chaining also applies when a person’s account becomes the launch point for multi-app compromise. Security teams should re-evaluate whether they can trace a single identity event across the whole trust chain.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
• For a broader breakdown of identity failure patterns, see 52 NHI Breaches Analysis and the control gaps it maps across real incidents.

What this signals

Context-aware phishing evasion will keep eroding the value of static URL reputation and mailbox-centric filtering. Teams that still rely on sender blocking and domain takedowns will see a growing gap between what users encounter and what security tooling records.

Identity programmes need to treat browser telemetry, SSO trust paths, and SaaS session controls as one joined problem. The organisations that can correlate those layers will contain compromise faster than those that still separate phishing response from access governance.

The pressure is moving toward unified detection across human identity and downstream application trust. If a phish can begin in a personal channel and end in a business system, then the programme boundary has already been crossed before the alert arrives.

For practitioners

• Expand phishing detection beyond email Instrument browser-based detection that observes page rendering, token theft behaviour, and suspicious login flows across social, search, and chat-delivered lures.
• Map SSO blast radius for high-risk accounts Identify which business apps inherit trust from core identity providers and prioritise those paths for stronger session monitoring and revocation.
• Harden session protection and revocation Shorten the window between suspicious authentication and containment by revoking tokens, forcing re-authentication, and alerting on anomalous browser sessions.
• Review third-party and personal-device exposure Assess where browser-saved credentials, personal accounts, and work devices intersect so a compromise in one context cannot launder into corporate access.

Key takeaways

• Non-email phishing breaks mailbox-centric security assumptions by moving the lure into channels that users already trust and security teams often do not monitor.
• A single stolen session can create enterprise-wide blast radius when SSO and connected SaaS apps inherit trust from one compromised identity.
• Security teams need browser-layer detection, rapid token revocation, and visibility across identity trust chains to limit the impact of modern phishing.

Key terms

• Attacker-in-the-middle phishing: A phishing method where the attacker proxies the victim's login in real time to capture credentials and session data. The user believes they are authenticating normally, while the attacker intercepts the exchange and can reuse the resulting session or token.
• Session hijacking: The reuse or theft of an authenticated session so the attacker can act as the legitimate user without re-entering the original password. In identity programmes, session hijacking matters because it can bypass some authentication controls and extend access across connected systems.
• Identity blast radius: The amount of downstream access that becomes available when one identity is compromised. In SSO-heavy environments, blast radius is determined by trust relationships between apps, session lifetime, and how quickly security teams can revoke access after suspicious activity.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by Push Security: non-email phishing, identity compromise, and modern evasion tactics. Read the original.