The Phish Gets Wise
Contributed by IDX
​​

For years, cybersecurity awareness training focused on helping employees spot the signs of a phishing email: poor grammar, suspicious sender addresses, urgent requests, and links pointing to unfamiliar websites.
 

For a while, that advice worked.
 

Today, however, many of the traditional warning signs have disappeared. Modern phishing campaigns increasingly rely on legitimate infrastructure, trusted platforms, and compromised accounts to blend seamlessly into normal business operations. The result is a new generation of phishing attacks that often look exactly like the work employees perform every day.

The New Face of Phishing

Three common phishing techniques illustrate how far these attacks have evolved.

1) The Shared File That Isn't a File

An employee receives a legitimate SharePoint notification indicating a coworker has shared a document requiring review or signature.

The email itself is genuine. It originates from Microsoft's infrastructure and may even come from a real colleague whose account has already been compromised.
 

Because nothing appears suspicious, security controls often allow the message through. The malicious activity occurs after the click, directing the user to a convincing sign-in page designed to capture session tokens rather than passwords. In many cases, this allows attackers to bypass traditional multi-factor authentication and gain immediate access to the account.

This remains one of the most common entry points into business email compromise incidents.

2) The Party Invitation at Your Desk

A friendly invitation arrives through a platform such as Evite or Punchbowl from someone you know. The invitation feels personal and harmless.
Unfortunately, the sender's account may already be compromised, allowing attackers to distribute phishing messages to their entire contact list.

Recipients who click the link are often presented with a familiar Microsoft or Google login page, unknowingly surrendering their credentials and helping the attack spread further.

3) The Meeting Update You Need to Join

A calendar invitation arrives through a legitimate scheduling service and directs users to join a virtual meeting. Before joining, participants are prompted to install a required update. The update is actually malware designed to steal credentials, browser data, and sensitive business information. Because meeting invitations are among the most trusted communications employees receive, they are increasingly being weaponized by attackers.
 

What's Changed?

All three examples share a common theme:

• The infrastructure is legitimate.

• The sender appears legitimate.

• The workflow feels legitimate.

• The malicious activity occurs after trust has already been established.
   

Rather than creating obviously fake messages, today's attackers borrow credibility from trusted systems and relationships.

The giveaway has largely been engineered out of the attack.

Building Better Defenses

Organizations should focus less on teaching employees to identify every phishing email and more on implementing controls that reduce the impact when one inevitably succeeds.
 

Practical steps include:

• Adopting phishing-resistant authentication methods.

• Verifying payment changes and credential resets through a secondary communication channel.

• Treating unexpected "sign in to view" or "update to join" requests with heightened scrutiny.

• Revoking active sessions after account compromise, rather than relying solely on password resets.

• Regularly reviewing inbox rules and forwarding settings for signs of unauthorized access.

• Monitoring for domain impersonation and brand abuse that could be used to support phishing campaigns.

Organizations should also pay attention to their external attack surface. Threat actors frequently register lookalike domains that closely resemble legitimate company brands, vendor portals, and login pages. These typosquatted and homoglyph domains are often used to support phishing campaigns that appear trustworthy at first glance. Identifying and monitoring these domains can provide early warning of potential threats and create opportunities to disrupt campaigns before employees or customers encounter them. These controls help reduce risk even when attackers successfully leverage trusted platforms and compromised accounts.

Preparation Still Matters

The phishing attacks causing the most damage today rarely look suspicious.

Organizations should also understand their external attack surface. Threat actors increasingly rely on lookalike domains that closely resemble legitimate company brands, vendor portals, and email infrastructure. Monitoring for these domains can provide early warning of phishing campaigns before they reach employees or customers. They look like normal business activity.
 

That reality makes preparation more important than ever. Organizations that regularly assess their readiness, validate response procedures, and strengthen authentication controls are better positioned to detect and contain these attacks before they escalate into costly incidents.

​

As part of its commitment to helping organizations improve cyber resilience, IDX offers a complimentary 30-minute Breach Readiness Review designed to identify practical opportunities to strengthen incident preparedness and response capabilities. Because the phishing email that succeeds tomorrow may look exactly like the one you received today. The goal is not simply to spot it. The goal is to be ready when it gets through.