Phishing trends show AI agent abuse and MFA bypass scaling fast

At a glance

What this is: Knowbe4 reports that phishing is spreading across Microsoft Teams, calendar invites, and AI-assisted inbox abuse while MFA bypass and DMARC evasion are scaling quickly.

Why it matters: It matters because identity verification controls are being stressed across messaging, scheduling, and authentication layers that many IAM and security programmes still treat separately.

By the numbers:

• Microsoft Teams attacks have surged by 41% in just six months.
• Calendar invite phishing has increased by 49% as attackers move into scheduling workflows.
• 84.4% of all successful phishing attacks now pass DMARC.

Context

Phishing is no longer confined to email inboxes. The current risk is that attackers can use collaboration platforms, calendar workflows, and AI systems to move trust abuse closer to everyday business activity, which makes traditional user awareness controls less reliable on their own.

For IAM and identity security teams, the important question is not whether phishing exists, but where verification fails when users, messages, and AI-generated content converge. This is increasingly a governance problem for human identity, MFA, and the trust assumptions embedded in digital workflows.

Key questions

Q: What breaks when MFA can be proxied through a reverse proxy?

A: What breaks is the assumption that completing MFA proves the session is trustworthy. In an AiTM attack, the attacker relays the login in real time, captures the session cookie, and can reuse that session without the second factor. Security teams need to treat session replay as the real failure mode, not just password theft.

Q: Why do social engineering attacks spread so easily across collaboration tools and email?

A: They work because these platforms are trusted for routine business interaction, which lowers user suspicion and helps attackers blend malicious messages into normal workflows. Shared files, direct messages, and meeting invitations create multiple entry points for phishing, impersonation, and credential theft. When controls are tuned only for email, attackers can move to adjacent apps and keep the same pressure on users.

Q: How should security teams handle prompt injection in inbox assistants?

A: Treat inbox assistants as part of the attack surface, not just productivity tools. If an AI system can summarise, rank, or rewrite messages, it can also be manipulated to hide malicious intent or amplify it. Teams should constrain what the assistant can act on, log its decisions, and keep a human verification step for sensitive requests.

Q: Should organisations rely on DMARC to stop phishing?

A: No. DMARC helps reduce spoofing, but it does not stop attacks that use valid infrastructure, collaboration channels, or post-delivery manipulation. Organisations should keep DMARC in place, but measure phishing resilience across the whole delivery chain, including session abuse, channel trust, and user action after delivery.

Technical breakdown

Why AI-assisted phishing changes the trust model

AI-assisted phishing changes the trust model because the attacker is no longer limited to generic lures or manual social engineering. Prompt injection can manipulate the systems that summarise messages or route work, turning trusted productivity tooling into an amplifier for deception. That creates a layered problem: the user sees a plausible artefact, the platform may process it as normal content, and identity checks can be sidestepped before a human realises anything is wrong. The result is not just better phishing text, but faster compromise paths that compress defender reaction time.

Practical implication: review AI-assisted mailbox and workflow tools as part of phishing risk, not as neutral productivity layers.

How reverse proxies and MFA bypass industrialise account takeover

Reverse proxies sit between the user and the legitimate service, relaying credentials and session data in real time so attackers can capture authenticated access without needing to break MFA directly. That pattern matters because many programmes still treat MFA as the end of the authentication story, when in practice it is only one step in a broader trust chain. Once a session is stolen or relayed, the attacker can often operate within the same access boundaries as the legitimate user, which makes detection and session control as important as initial authentication.

Practical implication: pair MFA with session theft detection, token protection, and conditional access controls that can interrupt relay attacks.

Why collaboration and calendar channels are becoming identity attack surfaces

Collaboration tools and calendar systems are attractive because users naturally trust messages that arrive through work-approved channels. A phishing message in a Teams thread or calendar invite benefits from that inherited trust, which can bypass the skepticism users apply to external email. In identity terms, the weak point is not only authentication but context: if a message lands inside an approved collaboration path, many users assume the sender and content are legitimate. That makes these channels a governance issue for digital trust, not just a messaging hygiene issue.

Practical implication: extend phishing controls, reporting paths, and content inspection to collaboration and scheduling platforms.

Threat narrative

Attacker objective: The attacker wants to gain authenticated access and use trusted business channels to scale compromise while avoiding obvious email-based detection.

1. Entry occurs through social engineering delivered in trusted channels such as Microsoft Teams, calendar invites, or AI-manipulated inbox workflows.
2. Credential or session abuse follows when reverse proxies or similar relays capture authenticated access and bypass MFA enforcement.
3. Impact is account takeover, faster compromise, and wider trust abuse across collaboration and identity workflows.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI-assisted phishing is now an identity governance problem, not just a user-awareness problem. When attackers can manipulate AI systems that summarise or route communications, the trust boundary moves from the inbox to the decision layer. That means security teams must account for how humans, machines, and AI intermediaries all participate in message trust. The practical conclusion is that identity assurance has to cover the workflow, not only the login.

Reverse-proxy MFA bypass exposes a standing assumption that MFA equals account safety. It does not. If an attacker can relay credentials and session state in real time, the control that was supposed to end the attack actually becomes only one step in a longer compromise chain. This is the kind of failure mode that makes session governance, token binding, and conditional access central rather than optional.

Collaboration platforms are becoming the new trust frontier for social engineering. Teams, calendar systems, and other workplace channels inherit legitimacy from business process, which is why phishing inside them often feels less suspicious than email. The identity lesson is that trusted transport does not equal trusted intent. Practitioners should treat these channels as governed identity surfaces.

DMARC reduces one class of deception, but it cannot carry the full burden of phishing defence. The figure that matters here is not whether email authentication exists, but whether adversaries can shift into valid channels and post-delivery manipulation. That is why anti-phishing strategy has to span identity verification, channel governance, and session protection. Teams should use DMARC as a control layer, not as the control layer.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Channel trust is becoming the decisive phishing variable. The most important change for practitioners is that attackers increasingly win by operating inside approved collaboration and scheduling paths, not by spoofing external senders. That means inbox-only defences will underperform unless teams extend policy, detection, and user reporting into Teams, calendar, and AI-assisted workflow surfaces.

Identity security teams should treat session control as a first-class phishing control. If attackers can relay authentication through a reverse proxy, the real failure is not password strength but session governance. Conditional access, token protection, and abnormal-session detection should be measured together because any one of them can become the weak point.

Prompt injection creates a new trust boundary around AI assistants. When an assistant can summarise or interpret messages, it can also be manipulated into changing what the user sees or believes. That shifts phishing defence from message filtering alone to governance over what AI tools are allowed to read, rewrite, and recommend.

For practitioners

• Extend phishing governance to collaboration platforms Include Microsoft Teams, calendar invites, and other internal messaging tools in phishing monitoring, user reporting, and content inspection workflows.
• Harden MFA against relay and session theft Add controls that detect reverse-proxy behaviour, suspicious token reuse, and impossible session transitions, then enforce conditional access responses.
• Review AI-assisted inbox tools for manipulation risk Assess whether summarisation, drafting, or routing assistants can be influenced by prompt injection or hostile content that changes what users see.
• Measure phishing beyond email spoofing Track successful delivery and compromise across valid domains, trusted collaboration channels, and post-delivery session abuse rather than relying on DMARC alone.
• Revalidate account recovery and step-up paths Check whether fallback authentication, recovery links, and step-up prompts can be abused after a session is established in a trusted application.

Key takeaways

• Phishing is expanding into collaboration tools, calendar workflows, and AI-assisted inbox systems, which means traditional email-only controls no longer cover the full attack surface.
• The report points to rapid scaling in both delivery channels and compromise speed, with Teams attacks, calendar invite phishing, prompt injection, and DMARC evasion all moving at the same time.
• Practitioners need to govern trust at the channel and session layer, not just at email authentication, because the attacker advantage now comes from legitimate-looking workflows.

Key terms

• Reverse Proxy MFA Bypass: A technique in which an attacker places an intermediary between a user and the legitimate service to relay credentials and session data in real time. The user completes MFA, but the attacker captures the authenticated session and can often act as the user without repeating the challenge.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Channel trust boundary: A channel trust boundary is the point at which the security team decides whether the network path can be treated as trusted or must be cryptographically defended. For WinRM, that decision drives whether HTTP is acceptable or HTTPS is required.
• Session Governance: The practice of binding access to a specific task, time window, and execution context, then revoking it when the work is done. For non-human identities, session governance matters because tokens and delegated permissions often persist longer than the action they were created to support.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management through an identity-first lens. It helps security practitioners connect identity controls to the broader governance decisions their programmes depend on.