Topic starter
14/07/2026 4:24 pm
TL;DR: Phishing is spreading beyond email into Teams, Slack, Zoom, LinkedIn, WhatsApp, and other collaboration channels, increasing account takeover and business email compromise risk, according to Proofpoint, which also cites Verizon, its own human factor research, and observed targeting of 99% of monitored organisations. Human awareness now has to cover identity abuse across every channel, not just inbox defence.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Strengthen Human Resilience During Cybersecurity Awareness Month—and All Year Long”.
By the numbers:
- 99% of the organizations Proofpoint monitors are regularly targeted for account takeovers.
Key questions
Q: What breaks when phishing moves beyond email into collaboration apps?
A: Email-only defence breaks because the attacker no longer needs to win inside the mailbox.
Q: Why do compromised supplier accounts create such high fraud risk in BEC attacks?
A: Compromised supplier accounts are dangerous because they inherit trust from an otherwise legitimate relationship.
Q: What are the signs that multichannel phishing is succeeding?
A: Watch for unusual requests arriving from familiar contacts, sudden changes to payment details, unexpected urgency, and messages that shift between channels to keep pressure high.
Practitioner guidance
- Broaden phishing detection across collaboration channels Extend monitoring, user reporting and simulated phishing coverage beyond email into Teams, Slack, Zoom, LinkedIn and WhatsApp, because the lure now arrives where inbox controls are absent or weaker.
- Require out-of-band verification for payment changes Create a mandatory callback or second-channel check for supplier banking changes, unusual invoices and urgent approval requests before they are accepted into workflow.
- Treat account takeover as a fraud incident When a user or supplier account is compromised, reset trust on that identity, review recent conversations and block any payment, file access or approval requests sent from the account.
Bottom line: Phishing now succeeds by exploiting trusted channels, not just by bypassing email filters.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:32 pm
Multichannel phishing is an identity governance problem, not just a message-security problem. Once attackers move across collaboration tools, social channels and messaging apps, the trust boundary is no longer owned by the email gateway. Security teams need to treat identity verification and user behaviour as control points across every communication path, not as awareness add-ons.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations govern supplier communications and payment changes?
A: They should require independent verification before any sensitive request enters a workflow, especially when money, credentials or confidential data are involved. That means separating request intake from approval, documenting trusted callback paths, and making exception handling visible to finance and security teams.
👉 Read our full editorial: Multichannel phishing and account takeover are redefining human risk