Notifications
Clear all
Topic starter
14/07/2026 4:25 pm
TL;DR: Recurring criminal tradecraft across BEC, supply chain, phishing, account takeover, subscription bombing, and indirect prompt injection shows how attackers keep blending human-targeted deception with credential theft and AI misuse to bypass controls, according to Proofpoint’s monthly stop-list. The pattern is operational, not theoretical: identity and access governance fail fastest where trust is implicit and verification is weak.
NHIMG editorial — based on content published by Proofpoint: The Cybersecurity Stop of the Month series roundup
Questions worth separating out
Q: What breaks when phishing is allowed to reach identity workflows?
A: Phishing becomes more damaging when it can trigger credential resets, payment changes, or privileged approvals without a second trust check.
Q: Why do supply chain attacks so often turn into identity incidents?
A: Because attackers are not only changing code, they are harvesting the non-human identities that code runs beside.
Q: How should security teams reduce indirect prompt injection risk in AI systems?
A: Security teams should limit what AI systems can read, separate untrusted content from privileged actions, and apply least privilege to every connected agent.
Practitioner guidance
- Tighten approval paths for high-risk identity events Require step-up verification for password resets, payment changes, OAuth grant approval, and any workflow that converts a message into a privileged action.
- Treat delegated access as lifecycle-managed identity Inventory vendor accounts, service credentials, API keys, and application grants together, then define clear ownership, expiry, and revocation rules.
- Constrain AI assistant tool permissions Separate untrusted content ingestion from tool execution, and only allow assistants to call approved tools within narrow policy boundaries.
What's in the full article
Proofpoint's full blog series covers the operational detail this post intentionally leaves for the source:
- Campaign-by-campaign examples of phishing, account takeover, and BEC tradecraft across the monthly series
- The specific attacker patterns Proofpoint observed in supply chain impersonation, QR code scams, and subscription bombing
- Operational detection and response details for teams that need to tune controls against recurring social engineering paths
- Scenario-level examples showing how AI-assisted deception changes message, identity, and approval workflows
👉 Read Proofpoint's monthly cybersecurity stop-list on phishing, account takeover, and AI abuse →
Phishing, account takeover and AI abuse: what teams should watch?
Explore further
14/07/2026 4:33 pm
Identity abuse is the common thread running through these monthly threat themes. Whether the entry point is phishing, vendor impersonation, account takeover, or AI-assisted deception, the attacker’s objective is usually the same: turn trust into usable access. That makes this roundup more than a list of incidents. It is evidence that IAM, PAM, and verification controls need to be designed as a connected system, not isolated checkpoints.
A question worth separating out:
Q: Who is accountable when account takeover or BEC leads to loss?
A: Accountability usually spans security, identity, fraud, and business operations because the failure often occurs at the boundary between communication trust and authorisation. Organisations should assign ownership for verification, approval, and revocation controls so that no single team can assume the other has closed the gap.
👉 Read our full editorial: Phishing, account takeover and AI abuse remain the month’s stop-list
