Topic starter
11/06/2026 11:14 pm
TL;DR: 34% of phishing attacks intercepted last month came through non-email channels such as social media, instant messaging, search ads, and in-app messages, according to Push Security, while a LinkedIn campaign used redirects, bot checks, and page obfuscation to steal Microsoft sessions. The pattern shows why email-first controls no longer define the full identity attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “New phishing campaign identified targeting LinkedIn users”.
By the numbers:
- 34% of the phishing attacks intercepted by Push last month came through non-email channels like social media, IM platforms, malicious search engine ads, and in-app communications.
Key questions
Q: What fails when phishing controls only monitor email?
A: Email-only phishing controls miss the delivery channels attackers now use to reach employees through social platforms, messaging apps, search ads, and in-app messages.
Q: Why do trusted services make phishing harder to detect?
A: Trusted services reduce suspicion because security tools often treat legitimate cloud domains and common platforms as low risk, even when attackers abuse them for redirects or hosting.
Q: How should teams respond when a Microsoft session is stolen?
A: Treat the event as identity compromise, not just credential theft.
Practitioner guidance
- Expand phishing coverage beyond email Include social media, messaging apps, search ads, and in-app communications in monitoring, user reporting, and response workflows because attackers are using those channels to start the attack.
- Inspect the full browser-rendered path Capture the redirect chain, final landing page, and runtime-loaded content so that trusted hosting and delayed rendering do not hide the real payload from analysis.
- Prioritise session revocation playbooks Build response steps for stolen Microsoft or Google sessions, including forced sign-out, token invalidation, and review of downstream SSO-connected applications.
Bottom line: LinkedIn and other non-email channels now function as viable phishing entry points, so email-centric control designs leave a real blind spot.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:49 am
Non-email phishing has become an identity governance problem, not just a mail security problem. When lures arrive through LinkedIn, messaging apps, and search ads, the control plane moves outside the inbox and into channels that identity programmes rarely govern end to end. The practical implication is that phishing resilience now depends on browser-time detection, session response, and channel-aware user protections.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: What is the difference between credential theft and session hijacking?
A: Credential theft targets usernames and passwords before authentication. Session hijacking targets the authenticated token after login, so the attacker bypasses the sign-in step entirely. In practice, session hijacking is often harder to spot because the activity can look like normal user behaviour until the token is revoked or expires.
👉 Read our full editorial: LinkedIn phishing bypasses email controls and steals corporate sessions
This post was modified 1 day ago by NHI Mgmt Group