Topic starter
02/08/2026 11:54 am
TL;DR: Attackers are reaching users through voice, legitimate platforms and secure email gateway bypass, KnowBe4 says, which weakens inbox-centric defences. Security teams need verification around recovery, approvals and support actions because the trust decision has become the target.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “2025 Phishing Threat Trends Report, Vol. 6”.
By the numbers:
- Vishing attacks increased by 449% in 2025, according to KnowBe4's report.
- Attacks sent from legitimate platforms increased by 70%, according to KnowBe4's report.
- Attacks bypassing secure email gateways increased by 38%, according to KnowBe4's report.
Key questions
Q: Why do vishing campaigns so often lead to account takeover?
A: Vishing works because it manipulates the human who is allowed to approve resets, confirm identities or authorise support actions.
Q: Why do legitimate-platform phishing campaigns bypass traditional controls so often?
A: They bypass traditional controls because many defences assume malicious delivery comes from suspicious infrastructure.
Q: What breaks when phishing moves from email into voice and approved platforms?
A: Traditional inbox controls break down because they only inspect one delivery path.
Practitioner guidance
- Strengthen help desk verification Require step-up verification for password resets, MFA resets and account recovery requests that arrive by phone or chat, especially when the request changes authentication state.
- Review trusted-platform sender assumptions Inventory SaaS and collaboration services that can deliver user-facing messages and remove implicit trust from any platform that can be abused for phishing or approval abuse.
- Add identity-aware checks to sensitive workflows Use transaction-specific verification for connected-app approvals, payment changes and privileged access requests so that a valid delivery channel does not equal valid authorisation.
Bottom line: Phishing is increasingly a trust and identity problem that reaches users through voice, branded platforms and legitimate workflows rather than only through email.
Glossary terms: Vishing, Legitimate-Platform Abuse, Secure Email Gateway, Cross-Channel Trust Abuse
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:02 pm
Phishing has become a trust orchestration problem, not an email problem. The important shift in this report is that delivery is no longer the main boundary. Attackers can reach the user through voice, trusted platforms or approved workflows, which means the control point has moved to how requests are verified before action is taken. For practitioners, that makes identity assurance at the moment of decision the real control surface.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should security teams prioritise identity verification or email filtering against modern phishing?
A: Identity verification should take priority for high-risk actions because the attacker can route around email controls through voice, messaging or trusted platforms. Email filtering still matters, but it no longer covers the full decision path that leads to access, approvals or recovery.
👉 Read our full editorial: Phishing threat trends show vishing and platform abuse rising fast
This post was modified 2 days ago by NHI Mgmt Group