Notifications
Clear all
Topic starter
14/07/2026 4:24 pm
TL;DR: Phishing is spreading beyond email into Teams, Slack, Zoom, LinkedIn, WhatsApp, and other collaboration channels, increasing account takeover and business email compromise risk, according to Proofpoint, which also cites Verizon, its own human factor research, and observed targeting of 99% of monitored organisations. Human awareness now has to cover identity abuse across every channel, not just inbox defence.
NHIMG editorial — based on content published by Proofpoint: modern cyberattacks exploit people across email and collaboration channels
By the numbers:
- 90% of security incidents involve the human element, according to Verizon’s research.
- 96% of users who took risky actions did so knowingly, according to Proofpoint’s 2024 State of the Phish report.
- 99% of the organizations we monitor are regularly targeted for account takeovers, according to Proofpoint.
Questions worth separating out
Q: How should security teams stop phishing that moves from email into chat apps and social channels?
A: Treat collaboration and messaging tools as first-class phishing surfaces.
A: Because the attacker inherits the user’s authority, context, and established trust relationships.
Q: What do organisations get wrong about email-based fraud?
A: Organisations often treat email fraud as a messaging problem when it is really a trust and workflow problem.
Practitioner guidance
- Expand phishing controls beyond email Apply URL rewriting, attachment analysis, and user reporting to Teams, Slack, Zoom, WhatsApp, and other collaboration channels where social engineering now lands.
- Add step-up verification for risky account actions Require secondary validation before fund transfers, supplier record changes, mailbox delegation, or access to confidential data, even when the request comes from a familiar account.
- Create a supplier callback process Verify bank detail changes and urgent payment requests through a known contact path outside the original message thread, and log the confirmation as part of the approval record.
What's in the full article
Proofpoint's full article covers the operational detail this post intentionally leaves for the source:
- Practical guidance for recognising multichannel phishing across email, chat, social, and text-based workflows.
- Examples of supplier impersonation and business email compromise patterns that show how fraud unfolds in real environments.
- The 2025 Cybersecurity Awareness Kit structure and how teams can use it to reinforce training across the year.
- Proofpoint's framing of people, process, and technology together in reducing account takeover risk.
👉 Read Proofpoint's analysis of multichannel phishing, supplier fraud, and account takeover →
Multichannel phishing and account takeover: what teams need to do?
Explore further
14/07/2026 4:32 pm
Multichannel phishing is now an identity governance problem, not just a messaging problem. The article is right to move beyond email, because the trust boundary has shifted into collaboration apps, supplier threads, and mobile messaging. That means verification, not just detection, has to be extended across every channel where a user can be manipulated into taking action. Practitioners should treat channel trust as a control surface, not a communication convenience.
A question worth separating out:
A: Look for fewer successful impersonation-led approvals, faster reporting of suspicious messages, and lower completion rates for unsafe actions under simulated pressure. Behaviour change is only credible when it shows up in workflow outcomes, not just training completion metrics or quiz scores.
👉 Read our full editorial: Multichannel phishing and account takeover are redefining human risk
