Topic starter
14/07/2026 4:27 pm
TL;DR: Malicious emails now use URLs four times more often than attachments, while attackers increasingly hide payloads behind authentication pages, scanner-detection logic, and trusted collaboration workflows, according to Proofpoint’s Human Factor Report Vol. 2. The control gap is no longer message filtering alone, but continuous inspection across the full user journey.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Beyond the gateway: how threat actors intentionally engineer attacks to evade email security”.
Key questions
Q: What breaks when phishing is hidden behind authentication pages or sandbox checks?
A: Email-only inspection breaks because the malicious destination is not visible until after the user authenticates or the page behaves differently in a real browser.
Q: Why do trusted collaboration channels increase phishing risk?
A: Trusted collaboration channels increase risk because users apply relationship context before they apply security skepticism.
Q: How should security teams detect URLs that behave differently for sandboxes and real users?
A: They should combine browser-level inspection with behavioural telemetry such as redirects, user-agent patterns, JavaScript execution, and navigation context.
Practitioner guidance
- Inspect the full click journey Move from delivery-time verdicts to time-of-click and post-click inspection so the hidden destination is evaluated after redirects and authentication prompts are resolved.
- Extend controls into collaboration platforms Apply detection and policy enforcement to calendar invites, shared documents, and messaging workflows that can synchronise content without email transport.
- Harden identity prompts used in lures Review external login prompts, file-sharing sign-ins, and CAPTCHA flows so users can recognise when authentication is being used as part of phishing delivery.
Bottom line: Phishing is increasingly designed to escape email gateways by hiding malicious content behind login prompts, sandbox checks, and collaboration workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:35 pm
Phishing is moving from message inspection to interaction inspection. The core failure here is the assumption that scanning the message or first landing page is enough to judge risk. Once attackers hide malicious content behind authentication, conditional logic, or rendered browser behaviour, the control point shifts to the moment of user interaction. Practitioners should treat this as a governance problem in the full delivery chain, not just an email hygiene issue.
A question worth separating out:
Q: When should organisations move from email filtering to broader workflow protection?
A: They should make that shift as soon as phishing begins using authenticated links, collaboration apps, or application-layer delivery paths that do not depend on email transport. At that point, inbox controls are necessary but no longer sufficient, because the attack surface has expanded into the user workflow itself.
👉 Read our full editorial: Email gateway evasion is shifting phishing into trusted workflows