Topic starter
27/06/2026 1:51 pm
TL;DR: Multi-stage QR phishing, thread-spoofed vendor impersonation, and AI-generated payroll fraud are increasingly bypassing legacy email controls by mimicking normal workflows, adding personalization, and exploiting human trust, according to Abnormal AI. The security problem is no longer just malicious content, but context-aware deception that static indicators miss.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “2026 Threat Forecast: Top Attacks Set to Increase Enterprise Exposure”.
Key questions
Q: What breaks when phishing looks like normal business email instead of a malicious link?
A: Legacy email security breaks when it depends on known bad indicators such as suspicious URLs, attachments, or obvious malware.
Q: Why do QR phishing and thread spoofing increase fraud risk in finance workflows?
A: They exploit the fact that finance teams are expected to move quickly when a request appears familiar and well documented.
Q: How can organisations detect payroll fraud before a direct deposit change is executed?
A: Organisations should look for subtle changes in sender identity, role-based language, and requests that rely on urgency or confidentiality.
Practitioner guidance
- Map email workflows to identity and approval checkpoints Identify where invoices, payroll updates, vendor changes, and document requests rely on trust rather than verification, then add control points that force a second signal before action proceeds.
- Separate mobile QR flows from routine access decisions Treat QR-based email requests as a distinct risk path because they move users outside standard mail inspection and into browser and mobile contexts where traditional controls may not apply.
- Require out-of-band validation for payment and bank-detail changes Use a step that confirms the requester and the change request through a channel independent of the original email thread before any funds movement or direct deposit update is approved.
Bottom line: Modern phishing is increasingly a workflow abuse problem, where attackers exploit legitimate-looking interactions rather than overtly malicious content.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:21 pm
Context-aware email deception is now a governance problem, not a filter problem: The attacks described here succeed because they mimic ordinary business interactions more closely than they mimic malware. That means the control failure is not just detection coverage, but a weak decision boundary at the point where people trust the workflow. Security teams need to treat email as an identity and process channel, not only a content channel.
A question worth separating out:
Q: Should teams rely more on behavioural signals than on static email indicators?
A: Yes. Static indicators miss attacks that are well written, personalised, and structurally consistent with business workflows. Behavioural signals are more useful when the objective is to decide whether the request itself fits the expected pattern for the person, process, and timing involved.
👉 Read our full editorial: Email threats are bypassing legacy controls through human trust