Phishing detection evasion now hinges on identity controls

At a glance

What this is: This resource breaks phishing into eight evasion phases and shows how attackers combine identity, delivery, and anti-analysis techniques to bypass common controls.

Why it matters: IAM and security teams need this lens because phishing is no longer just a mail problem; it is an identity attack path that can defeat SSO, MFA, and access controls.

By the numbers:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.

👉 Read Push Security's analysis of phishing detection evasion techniques

Context

Phishing has evolved from simple credential theft into a multi-stage identity attack path. The article’s central point is that attackers now mix targeting, delivery, camouflage, anti-analysis, MFA bypass, and account takeover to avoid the controls that IAM and security teams traditionally rely on.

That shift matters because the weak point is often not a single control, but the handoff between email security, browser protection, authentication, and identity governance. Once phishing is treated as an identity problem rather than a mail filter problem, the operational gaps become easier to see.

Key questions

Q: How should security teams defend against modern phishing that bypasses MFA?

A: Defence has to move beyond password and inbox protection. Teams should combine phishing-resistant authentication, session protection, link analysis, browser controls, and SaaS monitoring so the attacker cannot easily turn a successful lure into account takeover. The goal is to break the chain at multiple points, not rely on any single control to stop every campaign.

Q: Why do modern phishing campaigns still succeed even with strong IAM controls?

A: Because attackers are no longer targeting only login pages. They use relay kits, consent abuse, alternative delivery channels, and direct SaaS targeting to bypass the trust assumptions built into central identity controls. If IAM is evaluated only at sign-in, it misses the stages where the attack actually wins.

Q: What do organisations get wrong about phishing detection?

A: They often measure success by whether a suspicious message is blocked, when the more important question is whether the attack can still reach a valid session or account. Detection needs to account for page obfuscation, runtime changes, and post-delivery identity abuse, not just known-bad URLs or emails.

Q: How do security teams prioritise phishing controls across email, identity, and SaaS?

A: Prioritise the controls that stop an attacker from converting delivery into authenticated access. That usually means tightening authentication policy, limiting risky consent paths, reducing direct app exposure, and correlating signals across email, browser, IdP, and SaaS. The right question is where the chain still becomes usable, not which layer is most visible.

Technical breakdown

Phishing detection evasion now spans the full attack path

The matrix splits phishing into phases because different attacker objectives require different evasion techniques. Targeting chooses the right victim or app. Delivery gets the lure to the user through email, ads, messaging apps, or direct outreach. Camouflage hides the malicious link from scanners and users. Anti-analysis and page obfuscation make automated inspection harder. Defeat MFA and CA targets the authentication step itself, while account takeover represents the end state. The value of this structure is that it maps attacker adaptation to the specific control layer being bypassed, rather than treating phishing as a single event.

Practical implication: Map your detection and response controls to each phishing phase, then test where a single campaign can still cross from delivery to identity compromise.

AitM kits are now designed to bypass authentication controls

Attacker-in-the-middle kits sit between the user and the legitimate service, capturing credentials and session tokens in real time. That makes them especially effective against MFA because the attack does not necessarily need to crack a factor, only relay or steal the approved session. The article also points to alternative paths such as backup authentication downgrade and consent phishing, which sidestep the primary login flow entirely. In practice, this means the real objective is not just password theft, but defeating the trust path that the identity provider assumes is safe.

Practical implication: Treat authentication policy, session handling, and consent grants as part of one control plane, not separate defences.

Shadow SaaS expands the phishing target set beyond the IdP

The article notes that attackers are increasingly targeting business apps directly, including Slack, Mailchimp, Postman, and GitHub, rather than only attacking Microsoft, Google, or Okta front doors. That matters because these applications often contain data, integrations, and tokens that can be more valuable than the login itself. Once attackers can phish a SaaS app directly, identity governance has to account for app-specific access paths, not only federated sign-in. The control problem becomes broader than MFA coverage and extends into SaaS sprawl, delegated access, and privileged app workflows.

Practical implication: Inventory direct-app authentication paths and review where business-critical SaaS still bypasses central identity controls.

Threat narrative

Attacker objective: The attacker aims to convert user interaction into durable identity compromise that survives traditional phishing and MFA controls.

1. Entry occurs through targeted delivery channels such as email, paid search, messaging apps, or public social platforms, giving the lure a path around conventional inbox-only filtering.
2. Escalation happens when the kit camouflages links, defeats automated analysis, and relays or sidesteps authentication so the victim’s session or consent grant becomes the access path.
3. Impact is account takeover, after which the attacker can move into further exploitation through the compromised identity and its downstream SaaS permissions.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing is now an identity governance problem, not a mailbox problem. The article shows that the attack surface has moved from message filtering to the full path between lure, session, and account takeover. That means identity, email, browser, and SaaS controls have to be assessed as one chain of trust, not as separate products. Practitioners should stop judging phishing resilience by inbox hit rates alone and measure whether identity controls still hold after delivery succeeds.

Link camouflage is now a first-class control evasion tactic. Modern kits are built to defeat proxy inspection, safe browsing, and automated page analysis before the user even reaches an auth prompt. That makes the old assumption that malicious links are visibly detectable structurally weak. Identity trust collapse: the programme assumption that a link can be classified before authentication begins no longer holds when the page mutates, fingerprints inspectors, and changes behaviour at runtime. Practitioners need to treat the page itself as an adaptive adversary.

Direct-to-SaaS phishing exposes the gap between central IAM and app-level governance. When attackers target Slack, GitHub, or other business apps directly, federation no longer guarantees safety. The problem is not just whether the IdP is hardened, but whether app-level sessions, delegated consent, and shadow SaaS access are governed with the same discipline. Security teams should re-evaluate where identity policy ends and where high-value application access actually begins.

The fastest gains for defenders will come from collapsing attacker time-to-impact. The matrix is useful because it frames each technique around attacker objective, not just technical novelty. That lets teams focus on the stages where a lure becomes a usable session, which is where real containment decisions happen. Practitioners should use the phase model to prioritise controls that slow delivery-to-takeover chains and expose gaps in current detection coverage.

At-scale phishing is becoming commodified, which raises the baseline for every environment. As phishing infrastructure becomes templated and sold as a service, advanced evasion techniques move from elite campaigns into mainstream criminal use. That widens the gap between control assumptions and attacker practice across human IAM and SaaS access. The practical conclusion is that phishing governance now needs to assume sophisticated tradecraft by default, not as an edge case.

From our research:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
• 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite.
• To connect this to agent governance: read the 2026 Infrastructure Identity Survey for the broader access and control trends shaping AI identity programmes.

What this signals

Identity attack paths are converging across phishing, SaaS, and AI-era trust assumptions. The practical lesson is that organisations can no longer separate “phishing controls” from identity governance, because the attack wins when delivery becomes authenticated access. With 70% of organisations already granting AI systems more access than they would give a human employee performing the exact same job, per the 2026 Infrastructure Identity Survey, the broader lesson is that access policy discipline is already under strain.

Identity trust collapse: controls that assume malicious activity is detectable before authentication are increasingly brittle. Attackers are mutating pages, delivery channels, and consent paths at runtime, which means programme owners need to verify whether their current detection stack still sees the attack before account takeover occurs.

As phishing infrastructure commoditises, the baseline assumption for practitioners should be that advanced evasion is available to ordinary campaigns. That shifts the programme focus toward reducing time-to-impact, tightening app-level governance, and correlating identity signals across the full path from lure to session.

For practitioners

• Map phishing controls to attack phases Align detection, browser hardening, email controls, identity policy, and SaaS monitoring to the eight-phase model so coverage gaps are visible at each stage.
• Test MFA bypass paths explicitly Run red-team or purple-team exercises against AitM relays, backup-factor downgrade paths, and consent phishing so authentication assumptions are validated against real attack behaviour.
• Review direct SaaS access paths Inventory business apps that can be phished without going through the IdP, then tighten session governance, delegated consent, and app-specific access controls.
• Measure time-to-takeover, not just click rate Track how quickly a lure moves from delivery to account compromise and use that metric to prioritise controls that interrupt the attack before takeover completes.

Key takeaways

• Modern phishing is an identity compromise chain that extends from delivery to account takeover, so inbox-only defence is no longer sufficient.
• Attackers increasingly defeat controls by camouflaging links, relaying sessions, downgrading auth paths, and targeting SaaS apps directly.
• Security teams should map controls to each phishing phase and measure how quickly a lure can become a usable authenticated session.

Key terms

• Attacker-in-the-middle phishing: A phishing method where the attacker relays traffic between the victim and the real service in real time. The user may complete a normal-looking login while the attacker captures tokens or sessions, which can defeat MFA if the stolen session is accepted by the target service.
• Link camouflage: Techniques that hide or transform a malicious URL so scanners, proxies, and users are less likely to recognise it. This can include redirects, encoding, dynamic generation, and page behaviour changes that make the link harder to classify before authentication or click-time analysis.
• Consent phishing: An attack that tricks a user into granting an application access to their account or data through legitimate-looking consent flows. Instead of stealing a password, the attacker abuses the trust model of OAuth or app permissions to gain access without a traditional login breach.
• Shadow SaaS: Unmanaged or partially governed SaaS applications that sit outside central identity oversight. These apps can contain sensitive data, tokens, and integrations, making them attractive phishing targets because attackers can bypass stronger controls that exist only at the main identity provider.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by Push Security: modern phishing detection evasion techniques and the phishing matrix. Read the original.