Legitimate infrastructure in phishing: are your controls keeping up?

TL;DR: Attackers are routing phishing, vishing and BEC through trusted services such as Microsoft Bookings, Safe Links and vendor URL wrappers, so authentication checks pass while intent is hidden, according to IRONSCALES. The real control gap is assuming origin validation equals trust.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Best of the Worst: The Week Your Security Tools Became the Disguise”.

Key questions

Q: What breaks when phishing uses legitimate platforms or phone callbacks instead of a malicious payload?

A: When phishing hides behind legitimate services or phone callbacks, traditional URL scanners often return benign verdicts and post-delivery controls have little to intercept.

Q: Why do SPF, DKIM, and DMARC still fail in well-managed environments?

A: They usually fail because identity is fragmented across systems.

Q: What do security teams get wrong about callback phishing?

A: They often optimise for links and attachments, but callback phishing pushes the compromise into a phone conversation.

Practitioner guidance

• Harden redirect-chain inspection Force detonation and reputation checks through every hop in wrapped links, including vendor wrappers, nested redirects, and final destination hosts.
• Escalate DKIM body-hash failures Treat financial-request emails with DKIM body-hash failures as high-confidence anomalies, even when SPF and DMARC pass.
• Build callback-phishing playbooks Add verification steps for finance and operations teams when an email contains a phone number, billing urgency, or a request to call support.

Bottom line: Attackers are increasingly using legitimate delivery infrastructure to make malicious messages look routine and safe.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →