Phishing threat trends show vishing and platform abuse rising fast

At a glance

What this is: KnowBe4's report shows phishing is shifting toward vishing, legitimate-platform abuse and secure email gateway bypass as attackers exploit trust across channels.

Why it matters: IAM and security teams need to treat phishing as an identity and trust problem, not just an email filtering problem, because the attack path increasingly starts outside the inbox.

By the numbers:

• Vishing attacks increased by 449% in 2025, according to KnowBe4's report.
• Attacks sent from legitimate platforms increased by 70%, according to KnowBe4's report.
• Attacks bypassing secure email gateways increased by 38%, according to KnowBe4's report.

Context

Phishing has moved beyond the inbox into a broader trust layer that includes voice, branded platforms and service abuse. When attackers can reach users through legitimate-looking channels, classic email filtering and signature-based controls lose much of their value. The primary identity question is no longer only whether a message is malicious, but whether the organisation can verify who is really requesting action across channels.

This matters for IAM, PAM and broader identity programmes because social engineering now targets the human decision point that authorises downstream access. Vishing and platform abuse can create approval events, reset flows or delegated access that look legitimate to the receiving system. The article's focus on platform-hijack trends is typical of modern phishing pressure, not an edge case.

Scattered Spider remains a useful example of how social engineering, brand abuse and access manipulation can combine into repeatable intrusion patterns.

Key questions

Q: What breaks when phishing moves from email into voice and approved platforms?

A: Traditional inbox controls break down because they only inspect one delivery path. When attackers use voice, brand impersonation or trusted SaaS channels, the real target is the trust decision itself. Organisations need verification steps for recovery, support and message approval that do not depend on email reputation alone.

Q: Why do vishing campaigns so often lead to account takeover?

A: Vishing works because it manipulates the human who is allowed to approve resets, confirm identities or authorise support actions. Once that person accepts the request as genuine, the attacker can reach the authentication layer through a legitimate process rather than by cracking credentials directly.

Q: Why do legitimate-platform phishing campaigns bypass traditional controls so often?

A: They bypass traditional controls because many defences assume malicious delivery comes from suspicious infrastructure. When attackers use trusted SaaS accounts, compromised brands, or approved sending services, reputation-based filters become less reliable. Organisations need account behaviour monitoring, identity verification, and post-delivery detection to catch what gateway controls cannot see.

Q: Should security teams prioritise identity verification or email filtering against modern phishing?

A: Identity verification should take priority for high-risk actions because the attacker can route around email controls through voice, messaging or trusted platforms. Email filtering still matters, but it no longer covers the full decision path that leads to access, approvals or recovery.

Technical breakdown

Why vishing succeeds where email controls fail

Voice phishing works because it shifts the trust signal from message content to real-time conversation. A caller can create urgency, impersonate support, and steer the target toward a reset, approval or disclosure step that bypasses mail-based detection entirely. Unlike spam, vishing often lands in a workflow where the human is the control plane. That is why secure email gateways cannot detect or stop the initial decision trigger when the attack arrives by phone or callback channel.

Practical implication: treat help desk and callback processes as part of phishing defence, not just user awareness.

How legitimate platform abuse changes phishing delivery

When attackers use compromised or trusted platforms to send phishing, the message inherits reputational trust from the sender ecosystem. This is not merely email spoofing. It is abuse of a real service account, tenant, or workflow that makes domain reputation, SPF, DKIM and simple allow-lists less decisive. The result is a delivery path that looks operationally normal even when the content is malicious, which creates a governance gap between platform ownership and message trust.

Practical implication: review third-party and SaaS messaging trust assumptions as part of identity and access governance.

Why SEG bypass points to an identity-aware control gap

A secure email gateway inspects mail in transit, but phishing campaigns increasingly bypass that layer by shifting channels, exploiting legitimate services or luring users into interactive steps after delivery. The control gap is not only technical filtering. It is the absence of identity-aware verification at the moment an action is requested, such as a password reset, app approval or MFA prompt. Once the workflow leaves the mailbox, the SEG has little visibility into the real attack path.

Practical implication: move from inbox-only control to authenticated request verification and stronger step-up checks for sensitive actions.

Threat narrative

Attacker objective: The attacker wants to convert human trust into valid access or approvals that enable account takeover, data theft or repeatable follow-on campaigns.

1. Entry begins with vishing or a legitimate-platform message that establishes trust and directs the target into a live interaction or approval flow.
2. Credential access follows when the target discloses information, approves a request, or completes a reset that gives the attacker a foothold.
3. Escalation occurs as the attacker uses the trusted channel to extend access, impersonate the victim or reuse the compromised relationship for further campaigns.
4. Impact is account takeover, data theft, or broader intrusion using a delivery path that appeared legitimate to traditional email controls.

Breaches seen in the wild

• MGM Resorts breach 2023: A help desk call gave attackers Okta and Azure admin access at MGM, leading to ransomware, ten days of outages and a $100 million hit.
• Caesars Entertainment breach 2023: Social engineering of an IT support vendor let attackers copy Caesars loyalty database; about $15 million was reportedly paid.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing has become a trust orchestration problem, not an email problem. The important shift in this report is that delivery is no longer the main boundary. Attackers can reach the user through voice, trusted platforms or approved workflows, which means the control point has moved to how requests are verified before action is taken. For practitioners, that makes identity assurance at the moment of decision the real control surface.

Vishing is the clearest sign that human approval has become a privileged pathway. A phone call can trigger password resets, MFA resets, payment changes or connected-app approvals without ever touching the mail stack. That creates a governance blind spot where the user, help desk and identity system all see a legitimate request. The failure mode is not simply user susceptibility; it is a process that treats voice as sufficient proof.

Legitimate-platform abuse exposes a platform trust gap. When adversaries send phishing from real services, organisations inherit the platform's reputation while the attacker inherits its delivery credibility. This is where identity governance must extend beyond internal users to the trust relationships created with SaaS, messaging and support platforms. The field needs better verification of who is allowed to request, approve or originate actions across those channels.

SEG bypass shows why inbox controls cannot carry the full burden of phishing defence. Email gateways are still useful, but they are increasingly only one layer in a much larger attack path. Organisations need a named concept for this shift: cross-channel trust abuse, meaning the use of voice, platform reputation and workflow legitimacy to defeat mail-centric control assumptions. That concept belongs in every modern identity and awareness programme.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Cross-channel trust abuse: phishing programmes now need to account for phone, messaging and SaaS-originated requests that borrow legitimacy from normal business workflows. The practical shift is toward verifying the requestor before the action, not just inspecting the message after delivery.

For IAM and help desk teams, the risk is that recovery and approval processes become the easiest path into the account estate. Controls that only harden the inbox leave a gap at password resets, MFA resets and connected-app approvals, which are now primary social engineering targets.

For practitioners

• Strengthen help desk verification Require step-up verification for password resets, MFA resets and account recovery requests that arrive by phone or chat, especially when the request changes authentication state.
• Review trusted-platform sender assumptions Inventory SaaS and collaboration services that can deliver user-facing messages and remove implicit trust from any platform that can be abused for phishing or approval abuse.
• Add identity-aware checks to sensitive workflows Use transaction-specific verification for connected-app approvals, payment changes and privileged access requests so that a valid delivery channel does not equal valid authorisation.
• Expand phishing detection beyond email Correlate phone-based reports, callback abuse and suspicious platform activity in SOC and ITDR workflows so the team sees the full trust chain instead of only the inbox event.
• Rehearse social engineering response paths Run tabletop exercises that include vishing, help desk impersonation and legitimate-platform abuse so support teams can recognise when a request is technically normal but operationally unsafe.

Key takeaways

• Phishing is increasingly a trust and identity problem that reaches users through voice, branded platforms and legitimate workflows rather than only through email.
• KnowBe4's report highlights a sharp rise in vishing, platform abuse and secure email gateway bypass, showing how attackers are moving around inbox-centric controls.
• Security teams should harden account recovery, approval flows and cross-channel verification because those are the decision points attackers now exploit.

Key terms

• Vishing: Voice phishing is a social engineering technique that uses phone calls or voice channels to persuade a target to reveal information or approve access. It succeeds by exploiting trust, urgency, and procedural shortcuts, often bypassing technical controls that would have stopped a direct login attack.
• Legitimate-Platform Abuse: Legitimate-platform abuse occurs when attackers use trusted SaaS, messaging or collaboration services to send malicious content or create false legitimacy. The technique weakens filtering because the message originates from an approved platform rather than an obviously hostile source.
• Secure Email Gateway: A secure email gateway is a control layer that inspects email before it reaches users and can also inspect outbound mail. It filters malicious content, enforces policy, and reduces exposure to phishing, malware, and data leakage, but it does not replace identity governance or account monitoring.
• Cross-Channel Trust Abuse: Cross-channel trust abuse is the use of multiple communication paths, such as voice, messaging and SaaS notifications, to borrow trust from normal business operations. It matters because the attacker is no longer dependent on a single delivery channel, which weakens inbox-centred defence models.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity and workload identity in the context of modern access control. It helps practitioners connect identity assurance to the wider security programme that must withstand social engineering and delegated trust abuse.