Chat phishing is social engineering carried out through chat, messaging or collaboration tools to trick a person into revealing credentials, approving access, or running a malicious action. Attackers impersonate a trusted colleague, supplier or help desk and often use urgent language, compromised accounts or spoofed profiles to bypass normal caution and access controls.
What chat phishing is in practice
Chat phishing is effective because chat and collaboration platforms compress trust, speed, and action into a single thread. Attackers abuse that flow by appearing to be a colleague, supplier, or internal support contact, then pushing the target toward a credential handoff, a consent click, or a quick malicious action before normal verification happens.
The technique works across direct messages, group chats, shared channels, and collaboration suites, so the defensive problem is not just “bad messages”, but trusted workplace tooling being used as an impersonation layer. A strong reference point for this broader attack surface is the Collaboration Tool Security Guide.
How chat phishing bypasses normal caution
Chat phishing usually relies on urgency, familiarity, and platform context. A convincing profile, an existing compromised account, or a spoofed display name can make the message look routine, while the actual request is exceptional: reset this password, approve this prompt, share this file, or install this helper.
The attacker does not need a technical exploit in the chat product for the first step to work. The real weakness is human and procedural, the message arrives inside a channel people already use for work, so the request can feel operationally normal even when it is not. That is why phishing patterns across messaging and collaboration tools belong in the wider phishing model described in the Phishing Guide.
Common delivery paths and abuse patterns
Chat phishing shows up as supplier impersonation, help desk pretexting, “can you confirm this urgently?” requests, and account recovery scams. It also overlaps with account takeover, because a compromised trusted account is often more persuasive than a fresh spoofed profile.
In collaboration environments, attackers may use links to fake login pages, lure targets into approving OAuth consent, or pressure them into bypassing a normal approval workflow. When the request is framed as an internal task, users may treat it as a legitimate business message rather than a security event, which is why social engineering controls matter as much as platform controls. The broader pattern is covered well in the Social Engineering Guide.
Why the identity impact is often the real objective
Chat phishing often aims at credentials, active sessions, tokens, or an approval action that grants access without needing a password at all. Once an attacker gets that foothold, they can move from a single conversation to mailbox access, file access, SaaS control, or downstream business process abuse.
That is why the outcome matters more than the lure. A successful chat phish is rarely just a deceptive message, it is a trust violation that can expose identities, permissions, and secret-bearing workflows. Incidents such as Dropbox GitHub breach 2022 and Mailchimp breach 2022 show how social engineering can turn a trusted workflow into credential, key, and data exposure.
Risk and Threat Considerations
Chat phishing is dangerous because it exploits the fastest path to trust, a familiar chat interface, a plausible sender, and a request that seems time-sensitive. The impact is not limited to message deception, since one successful interaction can lead to account compromise, data exposure, unauthorized approvals, or broader internal impersonation.
Failure mechanism: The attacker reduces suspicion by operating inside a trusted collaboration channel, then uses urgency, impersonation, or a compromised account to trigger unsafe action before the target verifies the request.
Impact: The result can be credential theft, session compromise, malicious approval, or secondary access to systems and data that the chat account can reach.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Chat phishing often seeks phishing-resistant authentication bypass or credential theft. |
| Recommendation — Adopt phishing-resistant authenticators and verify high-risk approvals out of band. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Chat phishing targets passwords, tokens and other authenticators used in collaboration tools. |
| AC-7 — Unsuccessful Logon Attempts | Repeated chat-driven login lures often precede credential stuffing or takeover attempts. | |
| Recommendation — Manage authenticator lifecycle tightly and revoke exposed credentials immediately. Monitor failed authentication patterns and trigger response to suspicious login activity. | ||
| CIS Controls v8 | 5 — Account Management | Chat phishing frequently abuses account trust, access approvals and weak offboarding. |
| Recommendation — Enforce account lifecycle controls and remove stale collaboration access promptly. | ||
| MITRE ATT&CK | T1566 — Phishing | Chat phishing is a phishing delivery method that uses messaging and collaboration channels. |
| Recommendation — Map chat-based lures to T1566 and tune detections for impersonation and link abuse. | ||
Practitioner Guidance
Why practitioners should care: Chat phishing is a governance problem as much as a user-awareness problem, because the channel itself can blur the boundary between normal work and adversarial prompt. Teams should treat collaboration platforms as high-trust attack surfaces, not just communication tools.
What to watch for: Requests that create urgency, ask for an exception, or move a workflow away from established verification are the clearest warning signs. Messages that redirect the user to authenticate, approve, or download something should be treated as sensitive until independently verified.
Practitioner takeaway: The best control is not “be careful in chat”, it is making risky requests harder to complete without out-of-band verification and tighter collaboration tool governance.
Related resources from NHI Mgmt Group
- How should security teams stop phishing that moves from email into chat apps and social channels?
- Why do SMS and chat-based social engineering attacks succeed even when users are cautious about email phishing?
- What happens when attackers gain access to corporate chat systems and use them to launch phishing campaigns?
- Why do multi-stage phishing campaigns that move across email, chat, calendar, and cloud apps increase the risk of credential theft?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org