Precision phishing: what it means for email security teams

TL;DR: Phishing is shifting from spray-and-pray to highly personalised delivery, with attacks that auto-launch credential harvesters, prefill targets from QR payloads, and exploit trusted infrastructure while still passing SPF, DKIM and DMARC, according to IRONSCALES. Static attachment checks and authentication signals are no longer enough when the attacker has already profiled the recipient.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Best of the Worst: Five Attacks That Already Knew Your Name”.

Key questions

Q: Why do SPF, DKIM, and DMARC all matter for enterprise email security?

A: They solve different parts of the trust problem.

Q: What are the first signs that a phishing message is personalised rather than generic?

A: Look for recipient-specific references in the payload, not just the body text.

Q: How should security teams handle QR code phishing in email environments?

A: Security teams should inspect QR images, decode their destinations, and correlate that data with sender behaviour and message anomalies.

Practitioner guidance

• Audit reply paths in high-value threads Check Reply-To headers, CC recipient lists and thread continuity in invoice, banking and vendor-change conversations before approving action.
• Decode QR payloads before delivery Inspect QR destinations for personalised tokens, base64 fragments and recipient-specific redirects before the message reaches the end user.
• Treat document auto-actions as high risk Quarantine PDFs that trigger browser launches or external requests through OpenAction-style behaviour, even when static scans return clean.

Bottom line: Modern phishing now relies on prebuilt recipient intelligence, which makes traditional bulk-message assumptions increasingly unreliable.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →