TL;DR: Email attack volume is rising as Barracuda reports that one in three messages are malicious or unwanted spam, 48% of malicious email is phishing, and 90% of high-volume phishing campaigns now use phishing-as-a-service kits. Credential theft becomes an industrial process, so identity telemetry and email controls have to converge before attackers turn inbox access into persistence.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Barracuda's report: Email phishing is being industrialised by PhaaS, driving higher attack volume, more effective credential theft and more account takeover risk.
Why it matters: Identity and email teams need the same threat picture because credential theft now starts in the inbox and ends in account takeover, session abuse and lateral movement.
By the numbers:
- 34% of companies experience at least one account takeover incident every month.
- 48% of malicious email activity is phishing.
- 90% of high-volume phishing campaigns used phishing-as-a-service kits.
Context
Email abuse now behaves less like isolated spam and more like a high-throughput delivery system for credential theft. The governance gap is not only message filtering, but also the disconnect between email inspection, identity telemetry and endpoint containment when attackers move from lure to login.
Phishing-as-a-service lowers the skill threshold for attackers and shortens campaign setup time, which changes the operational burden on defenders. Phishing guidance remains relevant because the threat is still phishing at its core, but the delivery model has become more industrialised and more persistent.
Key questions
Q: How do phishing-as-a-service kits change email attack risk?
A: Phishing-as-a-service kits lower the skill and time needed to run large phishing campaigns by packaging templates, hosting and automation. That increases volume, makes attacks more consistent and often adds MFA-bypass capability through adversary-in-the-middle proxies, so defenders must detect not only bad messages but also stolen sessions and follow-on account abuse.
Q: What are the signs that an email account takeover is underway?
A: Common warning signs include unusual login patterns, unfamiliar devices or browsers, shifts in writing style or tone, and attempts to bypass multi factor authentication. Suspicious outbound mail from a normally quiet account, especially messages asking for payment changes or credential resets, can also indicate compromise. The key is to watch for small behavioral deviations, not just malicious attachments or links.
Q: What are the signs that QR code based phishing is being used to bypass email defenses?
A: A common sign is a message that pushes the recipient to scan a QR code instead of clicking a visible link. These emails often use urgency, expiring access, or MFA prompts to pressure immediate action. Security teams should treat QR codes in unexpected messages as a high risk signal and inspect the landing page, sender domain, and authentication flow before any credential entry.
Q: Why does mailbox compromise lead to lateral movement?
A: Mailbox compromise enables lateral movement because an attacker can read reset links, session tokens, shared credentials, and internal instructions, then use them to access other systems as that user. Compromised email also exposes contact chains and approval workflows, which help the attacker impersonate the account, pivot to SSO portals, and request additional access or password resets.
Technical breakdown
How phishing-as-a-service scales credential theft
Phishing-as-a-service packages phishing templates, hosting, fake login pages and automation into a subscription model. That turns phishing from a craft into a service, which means attackers can run more campaigns with less skill and more consistency. Many kits now include adversary-in-the-middle behaviour, where the fake page relays the victim's session in real time so the attacker can capture credentials and tokens while MFA is still in the path. See the Phishing-as-a-Service Platforms Guide.
Practical implication: Treat PhaaS as an operational threat model, not just a content problem, and tune controls for session theft as well as password capture.
Why HTML and PDF attachments still matter
HTML attachments can render local content and redirect users to external credential-harvesting pages, while PDFs often hide links or QR codes that bypass text-based inspection. The issue is not the file type itself, but the fact that the destination may be obscured until the user opens or scans it. That makes attachment security a blend of file analysis, URL detonation and behavioural inspection.
Practical implication: Inspect attachment behaviour, not just file extensions, because payloads now hide in formats that users trust and security tools often under-inspect.
How account takeover turns email into a persistence layer
Once an attacker gets mailbox access, the account becomes both a delivery channel and a control point. Inbox rules, forwarding changes and conversation hijacking let the attacker stay hidden while sending trusted-looking mail to contacts or business partners. That shifts the problem from initial phishing to durable misuse of a legitimate identity, which is why the identity layer matters as much as the email layer. See the Account Takeover Prevention Guide.
Practical implication: Correlate email anomalies with identity events so mailbox rule changes and risky sign-ins trigger containment before the account is reused.
Threat narrative
Attacker objective: The attacker aims to obtain trusted account access that can be reused for phishing, data theft, payment fraud and downstream lateral movement.
- Entry begins with phishing email, spoofed impersonation or malicious attachment that pulls the user into a fake login flow.
- Credential_harvested follows when PhaaS or AiTM tooling captures passwords, session tokens or MFA artefacts in real time.
- Escalation occurs when the attacker uses the compromised mailbox to change inbox rules, forward messages or send trusted phishing from the victim account.
- Impact is account takeover, followed by lateral movement, impersonation and financial or data theft from the trusted identity.
Breaches seen in the wild
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
- Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Phishing has become a credential supply chain, not a standalone lure. Barracuda's data shows the threat is now industrialised through PhaaS, which reduces attacker effort and increases campaign volume. That matters because defenders are not just filtering messages anymore, they are interrupting a repeatable access path into identity systems. The field should treat mailbox access as a privileged control surface, not a communications problem.
Account takeover is the real control failure exposed by modern email abuse. When 34% of companies see at least one ATO incident every month, the weak point is the assumption that inbox compromise stays local to email. In practice, mailbox access becomes a trust amplifier for impersonation, business email compromise and lateral movement. The governance lesson is that email security and identity security now fail together or succeed together.
QR code phishing creates an off-endpoint trust gap. QR codes move the user interaction from the monitored desktop into a phone or external browser, where visibility and policy enforcement are often weaker. That means the relevant control is not only link scanning, but the ability to govern where a credential prompt is allowed to occur. Organisations that ignore this shift leave a path open for credential capture outside their normal inspection stack.
Mailbox persistence should be treated as a named failure mode: inbox-rule persistence. Once an attacker can change forwarding or deletion rules, the compromised account can hide its own abuse and continue to distribute trusted-looking mail. That is a governance gap in identity lifecycle control, because the account is still active but no longer operating within expected behaviour. Practitioners need to treat post-login abuse as a first-class identity signal, not an afterthought.
What this signals
Inbox-rule persistence: the most dangerous phase of email compromise starts after the first login, when attackers convert a mailbox into a hidden relay for trust abuse and internal phishing. Email monitoring should therefore feed identity response, because the control failure is persistence inside a legitimate account, not just delivery of a malicious message.
Security teams should prepare for more attacks that begin in email and end in identity abuse, especially where mobile scanning, external browsers and consumer-style workflows weaken the control boundary. The practical shift is toward real-time inspection of links and attachments plus automatic response when account behaviour diverges from the owner's baseline.
For practitioners
- Harden phishing response with identity telemetry Correlate risky sign-ins, impossible travel, inbox rule changes and outbound anomalies so account takeover is contained quickly after initial access.
- Block or detonate high-risk attachment types Apply stricter handling to HTML attachments, PDFs and Microsoft 365 documents by inspecting embedded redirects, scripts and QR codes before delivery.
- Enforce phishing-resistant authentication where possible Use stronger MFA and session-aware access controls so stolen credentials or intercepted sessions are less useful to attackers.
- Tune anti-impersonation controls for high-volume campaigns Raise detection and policy sensitivity for spoofing, lookalike sender patterns and unauthenticated mail during spam surges.
Key takeaways
- Phishing-as-a-service has turned email abuse into a scaled access model that lowers attacker effort and raises campaign volume.
- Account takeover is the operational endpoint that matters most, because a compromised mailbox becomes a trusted platform for impersonation and persistence.
- Defenders need to connect email inspection with identity and endpoint response, or the attack will simply move from the inbox into the account layer.
Related NHI Mgmt Group resources: Phishing Guide · Account Takeover Prevention Guide · Phishing-as-a-Service Platforms Guide · QR Code Phishing (Quishing) Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | AiTM phishing and stolen sessions undermine authentication for email and identity accounts. |
| NHI-02 — Secret Leakage | Phishing campaigns aim to steal credentials, tokens and other secrets through fake login pages. | |
| Recommendation — Harden authentication flows against session interception and reduce reliance on reusable credentials. Treat credential capture attempts as secret leakage events and revoke exposed tokens immediately. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The report centres on phishing, ATO and post-compromise account abuse as the attack path. |
| Recommendation — Map phishing and mailbox abuse to credential access and lateral movement, then prioritise detections accordingly. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Account takeover and mailbox rule abuse show why access rights must be continuously governed. |
| Recommendation — Apply PR.AA-05 to review entitlements, forwarding rules and trust relationships for abused accounts. | ||
| CIS Controls v8 | CIS-5 — Account Management | The report shows that compromised accounts and inbox persistence are central to the threat pattern. |
| Recommendation — Use CIS-5 to govern account lifecycle, disable misuse quickly and remove stale access paths. | ||
Key terms
- Phishing-as-a-service: A criminal service model that packages phishing infrastructure, templates, delivery tools, and sometimes evasion features for reuse by multiple attackers. It lowers the skill threshold for advanced campaigns and makes targeted identity abuse more repeatable across victims and sectors.
- Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
- Adversary-in-the-Middle (AiTM): An attack pattern where the adversary sits between the user and the service to capture or replay authentication data and session state. The victim may still log in successfully, which is why the compromise often appears legitimate until privileged actions begin. AiTM is especially dangerous for admin workflows that trust issued sessions too much.
- QR Code Phishing: A phishing method that hides a malicious destination inside a QR image instead of a visible link. The code is scanned by a user device, which can move the victim into a login page, credential prompt, or session capture flow that bypasses simpler link-based inspection.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle and secrets management. It helps security practitioners connect access risk to the controls that govern identities and credentials across the programme.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org