Topic starter
11/06/2026 10:49 pm
TL;DR: Phishing became omni-channel in 2025, with roughly 1 in 3 attacks detected by Push Security arriving outside email and attacker toolkits increasingly bypassing MFA, consent controls, and browser defenses through AiTM kits, device-code abuse, and browser-native social engineering. The browser, not the inbox, is now where identity compromise is most likely to begin and where detection strategy has to catch up.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “2025âs top phishing trends â and what they mean for your 2026 security strategy”.
By the numbers:
- Roughly 1 in 3 phishing attacks detected by Push Security were delivered outside email in 2025.
Key questions
Q: How should security teams defend against phishing when attacks move beyond email?
A: Security teams should shift from inbox-centric prevention to browser-aware detection, stronger app-consent governance, and post-login monitoring.
Q: Why do phishing-resistant authentication methods still fail in real attacks?
A: Phishing-resistant authentication reduces password replay, but it does not eliminate session theft, consent abuse, or browser-native social engineering.
Q: What are the signs that browser security controls are not keeping up with modern phishing tactics?
A: Common signs include employees clicking malicious links, repeated exposure to spear phishing and browser in the browser attacks, and heavy reliance on external threat feeds instead of direct inspection.
Practitioner guidance
- Broaden phishing detection beyond email Correlate browser activity, search-ad referrals, social-message lures, and OAuth consent events so non-email campaigns enter the same detection queue as inbox phishing.
- Review authentication fallback paths Map every backup login route, device-code flow, and consent-based grant that can bypass phishing-resistant authentication when the primary factor is not available.
- Instrument browser-session telemetry Track suspicious token issuance, rapid session creation, unusual extension behaviour, and browser-native prompts that precede account takeover.
Bottom line: Phishing in 2025 was shaped by identity abuse across non-email channels, not just by better email lures.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:11 am
Omni-channel phishing has outgrown inbox-centred IAM assumptions: The browser, search results, and messaging platforms are now part of the identity attack surface. Email security can reduce exposure, but it no longer defines the boundary of phishing risk. Practitioners need to govern the channels where users actually authenticate, consent, and launch sessions.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: What should teams do when OAuth consent or device-code flows are abused?
A: They should revoke the grant or token, review the connected application, and inspect related sign-ins for lateral use of the same session. The key issue is not just the initial approval, but whether that approval created durable access that can persist beyond the user’s intent.
👉 Read our full editorial: Phishing shifted beyond email in 2025 and IAM controls lagged
This post was modified 1 day ago by NHI Mgmt Group