Phishing adapts to enterprise workflows, not just employee mistakes

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Phishing is increasingly tuned to enterprise workflow patterns, with attackers using redirects, shorteners, shared-document lures and brand impersonation to look routine.

Why it matters: IAM and security teams need to treat phishing as a behaviour-matching problem across human identity, SaaS access and workflow trust, not only as a training problem.

By the numbers:

• Phishing represents 58% of nearly 800,000 observed attacks across 4,600+ organisations.
• File-sharing phishing hits financial services at 22.2% and construction at 21.3%.
• Brand impersonation reaches 24.1% in hospitality, more than double the 12% sample average.

Context

Phishing has moved beyond obvious scams and now behaves like a workflow attack. The question for identity and security teams is not whether users can spot bad grammar or suspicious urgency, but whether the organisation's normal tools, channels and routines are being used against it.

This matters because trust is increasingly embedded in everyday identity interactions: document sharing, brand notifications, link redirection and SaaS login prompts. When attacks imitate legitimate business processes, controls designed around employee vigilance lose effectiveness unless they are paired with contextual detection and identity-aware policy.

Key questions

Q: How should security teams reduce phishing risk when attacks blend into normal work?

A: Treat phishing as a workflow and trust problem, not only an email-filtering problem. Focus on the platforms, brands, and document-sharing patterns employees already use every day, then harden the highest-trust paths with stronger inspection and verification. Training should reflect real organisational behaviour, not generic warning signs. The goal is to make ordinary-looking lures easier to question before engagement.

Q: Why do link shorteners make phishing harder to stop in enterprise environments?

A: Link shorteners hide the final destination behind a trusted-looking intermediate URL, which weakens reputation checks and slows inspection. They are especially effective where organisations already block obvious malicious domains, because attackers can rely on a mainstream shortening service or trusted redirect infrastructure. Defenders need URL expansion and destination resolution before the link reaches the user.

Q: What are the warning signs that phishing is targeting a specific industry workflow?

A: Messages that imitate the collaboration tools, document services or branded platforms common in a sector are a strong clue. Financial services, construction and hospitality are especially exposed because document exchange and brand notifications are routine enough that attackers can hide inside expected behaviour.

Q: What happens when organisations try to stop phishing with awareness training alone?

A: Awareness training alone leaves a major gap because phishing attacks change faster than user behavior does. Users may recognise generic scams, yet still miss impersonation, supplier fraud, and credential theft. Without layered controls, one successful message can lead to account compromise, data breach, or ransomware, while IT teams absorb extra remediation work after the fact.

Technical breakdown

Redirect chains and link shorteners hide the real destination

Redirect-based phishing inserts one or more intermediate URLs between the email and the final malicious page. That extra hop makes the true destination harder to inspect, especially when secure email gateways and web filters evaluate only the first URL they see. Link shorteners intensify the problem because they collapse the visible address into a generic, low-suspicion domain. In larger enterprises, that obfuscation becomes more valuable because URL reputation and scanning controls are more likely to catch a direct malicious link. The result is not just concealment, but adaptive concealment that shifts with the target's defensive maturity.

Practical implication: inspect redirect chains and shortener domains as part of URL policy, not as benign transport.

File-sharing phishing exploits document-heavy identity workflows

File-sharing phishing works because cloud document exchange has become a normal part of business identity behaviour. The attacker sends a lure that looks like a shared file, an e-signature request or a collaboration notification from a familiar platform, then relies on the recipient's expectation that such messages belong in the workday. The technical trick is less about payload sophistication than about embedding the lure inside a trusted SaaS interaction pattern. Financial services and construction are exposed because external document exchange is constant, which makes an unsolicited document prompt feel routine rather than suspicious.

Practical implication: treat shared-document notifications as identity events that need contextual validation and routing controls.

Brand impersonation borrows trust from the services employees already use

Brand impersonation succeeds when the fake login prompt, alert or payment notice closely matches the services a workforce already trusts. In hospitality, that includes booking systems, payment gateways, review sites and loyalty programmes. The phishing message does not need to look exotic because the target environment already contains many branded interactions. That means the attacker is not impersonating a random company, but a known operational dependency. The security issue is therefore trust substitution: an identity control weakness where the recipient transfers trust from a legitimate brand to a malicious clone.

Practical implication: align phishing detection and user verification steps to the specific brands and SaaS workflows employees actually see.

Threat narrative

Attacker objective: The attacker aims to collect credentials or drive account compromise while avoiding user suspicion and automated link-blocking controls.

1. Entry occurs through a phishing email or message that contains a redirect, shortened URL or imitation of a shared document or branded service.
2. Credential capture or payload delivery happens when the recipient follows the lure into a lookalike login flow or malicious destination that blends with normal work activity.
3. Impact follows when the attacker harvests credentials, gains account access or preserves stealth by hiding inside trusted communication and SaaS channels.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing has become a workflow conformity problem, not just a human error problem. The article shows that attackers are matching lures to the tools and routines employees already trust. That shifts the security question from whether users are careless to whether identity and messaging controls can distinguish routine from manipulated routine. For practitioners, the implication is that behaviour-aware controls now sit alongside training as a core line of defence.

Identity trust is the real target when phishing impersonates SaaS brands and document workflows. In financial services, construction and hospitality, the lure works because a shared file, booking alert or payment notice is already a normal business event. That makes phishing an IAM adjacency problem as much as a mail problem, because the attacker is exploiting the trust chain between human identity, SaaS identity and workflow context. Teams should treat those trust chains as governed surfaces, not incidental channels.

Static awareness training cannot keep pace with adaptive phishing tactics. Training that focuses on obvious scams leaves out the attacks that blend into legitimate operations. The stronger control model is one that combines user education with contextual inspection, brand-specific validation and behavioural anomaly detection. For identity programmes, that means moving from generic caution to environment-specific trust reduction.

Phishing is increasingly a control-evasion strategy tuned to enterprise size. The report shows redirect use is more common in smaller organisations, while link shorteners are more common in larger enterprises where URL scanning is stronger. That is a sign of attacker adaptation, not random technique selection. The practitioner takeaway is that the control stack itself influences which lure formats will be used against you.

Workflow-aware phishing defence needs to be part of IAM governance. When document exchange, login prompts and external brands are routine, the security model must account for those patterns in policy, detection and recertification conversations. That is where identity governance, messaging security and user behaviour analysis converge. The field is moving toward contextual trust management, and practitioners should plan accordingly.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Workflow-aware phishing defence is now an identity governance issue. When attackers align lures to the tools employees already use, the weak point is not simply user caution. It is the organisation's ability to govern trust across collaboration platforms, file-sharing systems and branded notifications without assuming every familiar-looking message is safe.

Phishing controls need to reflect local behaviour patterns. A generic anti-phishing programme will miss the lures that succeed because they look normal in a specific environment. Teams should tune detection, validation and user guidance to the brands, document flows and login prompts that dominate their own business processes.

For practitioners

• Map the organisation's routine trust surfaces Inventory the branded platforms, document-sharing tools, payment flows and notification paths employees see most often, then prioritise those surfaces for phishing controls and detection tuning.
• Tune URL inspection for redirects and shorteners Treat multi-hop URLs, shortener services and trusted redirect domains as high-risk signals, especially where attackers can hide behind reputable infrastructure.
• Align awareness training to actual workflows Replace generic phishing examples with examples drawn from the organisation's real collaboration, document exchange and SaaS login patterns so users learn to question routine-looking messages.
• Add brand-specific validation rules Build controls that verify unexpected requests from the brands employees actually use, especially in high-exposure sectors such as hospitality, financial services and construction.

Key takeaways

• Phishing is succeeding by mirroring the work patterns people already trust, which weakens security approaches built around spotting obvious mistakes.
• The article's figures show that the tactic is both high-volume and adaptive, with redirect chains, file-sharing lures and brand impersonation shifting by enterprise size and industry.
• Practitioners need behaviour-aware controls, sector-specific validation and workflow-based awareness, not training content that only covers generic scams.

Key terms

• Redirect chain: A redirect chain is a sequence of intermediate links that forwards the victim from an initial lure to the final malicious page. Attackers use it to hide the destination, defeat static URL analysis, and exploit trusted services that are less likely to be blocked early.
• Link Shortener: A link shortener compresses a long URL into a compact, often generic-looking address. In phishing, it helps attackers disguise the destination, reduce suspicion, and sometimes bypass simple reputation-based blocking because the visible link gives away little about the final site.
• Brand impersonation fraud: A fraud pattern in which attackers mimic trusted organisations to trigger urgent action, capture credentials, or collect payment data. The technical risk sits at the intersection of identity verification, channel assurance, and user trust, which is why security and fraud teams both own the response.
• Workflow Phishing: Workflow phishing is phishing that mimics the normal business processes people expect, such as document sharing, e-signature requests or SaaS notifications. The attack succeeds by fitting into existing habits, which means the security model must understand the workflow context, not only the message content.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.