Beyond Email Phishing: How Attacks Spread Across Messaging Apps and Collaboration Tools

Phishing Has Found New Channels: From Inbox to Chat

Phishing attacks are no longer limited to your inbox. The email-only menace has spread its wings and now lurks on different digital channels. While email remains the most widely used channel for business communication, other tools have entered the ring that are now scaling the popularity charts for communication and collaboration.

Slack, MS Teams, WhatsApp for Business, and even LinkedIn are on attackers’ radar. Attackers move with the times, and a shift in how modern work is done is expanding their attack surface.

It’s not hard to guess the reasons why phishing has broken out of the inbox:

• The rise of the remote and hybrid work, where teams are scattered across geographies, and changes in the way they collaborate, communicate, and share work.
• Increase of IT sprawl that many times calls for optimal management, governance, and extensive security that doesn’t happen or doesn’t meet the speed of growth, scale, and scope of the sprawl.
• The rise of the BYOD (Bring Your Own Device) culture that is blurring the lines between personal and professional, creating more entry points for cyber criminals.

The result is a wider, messier attack surface. To put it simply, the decentralization of business communication is therefore writing a new chapter in the history of phishing.

But more than any other factor, the emergence and ongoing evolution of AI-powered deception are making phishing even more potent. Attackers are now using generative models to craft compelling context-aware, relevant, and specific-platform-oriented messages that are difficult to distinguish from the real deal. It’s an evolution of the phishing tactics that once dominated inbox-based attacks, only now amplified by AI precision and speed.

Slack, Teams, WhatsApp, LinkedIn – New Frontiers

The battleground has expanded. Security professionals must remove their inbox-tinted glasses and look at Slack, Microsoft Teams, WhatsApp, and LinkedIn as the initial access vectors for phishing.

Nearly 40% of recent campaigns [1] now spill over into these collaboration and social channels. We are increasingly reading news reports of hacker groups leveraging information on these channels to launch targeted phishing attacks.

But why is this happening? Why are these channels the new frontiers of phishing? The answer lies in their adoption and the fact that this is where the regular communications occur. Moreover, while incoming emails in an inbox are viewed with natural suspicion, given the security awareness of email phishing, these channels are still implicitly trusted by users. This trust, coupled with the speed of messaging, is making these platforms criminals’ first choice.

Imagine a message popping up on Teams from your manager, a Slack thread calling for immediate action, or a LinkedIn connection with a very personal message. Such messaging sounds very familiar, and it is this familiarity that hackers exploit.

Moreover, while layers upon layers of security protect organizational inboxes due to secure email gateways and anti-phishing solutions, a similar layer of defense typically does not cover these communication and collaboration tools.

Real World Examples of ‘Beyond-Inbox’ Phishing Scams

• Back in early 2025, Bitdefender Labs identified a LinkedIn phishing [2] campaign by the North Korea-linked Lazarus Group. This campaign involved sending fake but legitimate-looking recruitment messages offering crypto-related roles. The campaign objective was to steal data and drop malicious malware.
• Another example is a LinkedIn phishing scam unearthed by Push Security [3] targeting high-net-worth individuals with fake job offers, designed to harvest session cookies and Microsoft credentials.

• In 2021, EA Sports was hit by a Slack-based phishing attack in which an employee was tricked into leaking a multi-factor authentication token. Result – criminals gained access to the Electronic Arts internal network. Once the attackers gained access, they escalated privileges and stole a colossal 780 GB of sensitive data. But if you thought this happened way back and such phishing attacks are a thing of the past, you are mistaken.

  Latest advisories [4] from security agencies warn of phishing attacks by the Scattered Spider hacking group, which is targeting platforms such as Slack and Microsoft Teams. The groups are gathering internal intelligence, allowing them to launch highly targeted phishing attacks. Their focus is on data theft and extortion.

• WhatsApp scams are also frequent nowadays. There was a scam that started like any ordinary office chat – only this one came from a fake boss. In a slick case of corporate identity theft, [5] cybercriminals impersonated Greenko Group’s managing director on WhatsApp and convinced employees to transfer crores in minutes. A reminder that in today’s world, even a familiar display picture can empty your accounts.

These real-world phishing statistics make it very clear that the old ‘check your email’ message for telltale signs of phishing no longer suffice. The new frontiers of phishing are on attackers’ radars, which means they should be on security teams’ radars as well.

Cross-Platform Unified Threat Management

The threat landscape is becoming even more complex due to fragmentation. However, your cybersecurity posture can address this fragmentation with unification. With each channel beyond email generating its own telemetry logs and alerts, and with gaps, a unified approach to threat management helps create a security umbrella that brings all signals, events, and policies under one roof.

Importance of Unified Threat Management

UTM ensures a unifying security layer that consolidates information from different security solutions into a single, orchestrated architecture. This ensures that every alert, regardless of its source – whether email gateways, endpoints, IAM, or more – is correlated and acted upon. It delivers much-needed holistic visibility, essential for understanding attacker movement and strengthening phishing protection across your organization’s communication ecosystems.

Centralized Control for Unified Phishing Protection

A unified approach to phishing threats means you can leverage a unified dashboard to ensure clear information dissemination. Security teams can get a ringside view of cross-platform alerts, ongoing incidents, and corrective measures through a single interface. This reduces response times. No longer do security teams move from one security tool to another. They can do so from a single dashboard and manage activities right from detection to containment.

Moreover, centralized visibility segues to centralized control. Users can define and enforce cross-geography security policies. These can include setting access privileges, restricting data sharing, and MFA requirements. Any deviation or policy drift is automatically flagged, ensuring every platform aligns with organizational standards and compliance mandates.

Threat Intelligence and Automated Playbooks for Phishing Response

Threat Intelligence Platforms (TIPs) feed intelligence into the unified security layer, including external threat feeds, behavioural analytics, and zero-day indicators. This helps the cybersecurity framework adapt quickly to evolving and emerging security threats.

Adaptation should lead to response. This response should be fast, coordinated, and repeatable. Unified threat management enables security teams to automate phishing response playbooks. As soon as an incident is detected, the playbook is executed. This ensures that accounts are quarantined, domains are blocked, tokens are revoked, and all stakeholders are notified quickly.

Security Awareness Training for Modern Communication Tools

With phishing goalposts shifting, traditional security awareness training should shift too. Your employees need to be told that phishing can happen via email and other channels and that the fundamentals of email security best practices still apply, no matter the medium. Your workforce is the soldiers in the line of fire from phishing attacks from various quarters, and they need to be able to put their guards up. If they win, your organization wins against phishing attacks.

1. Addressing Shortcomings in Phishing Awareness Training

   Email-only programs that train employees to look for red flags like subject lines and bad domains, but do not address the risks emanating from social or collaboration platforms, need to change. It is imperative to note that the nature of Slack and MS Teams messaging is different. You need to evolve your security awareness modules to teach users how to verify a message in a thread, authenticate a file-share request, or question a “quick favor” DM from a known manager.

2. Transitioning to Multi-Channel Anti-Phishing Awareness

   Training simulations now need to include examples from Slack messages, Teams invites, WhatsApp texts, and LinkedIn job offers. The goal isn’t just spotting malicious content – it’s developing instinctive scepticism across platforms. Scenario-based learning – often reinforced through internal phishing simulation campaigns (e.g., “Your CFO messages you on Teams about an urgent payment”) helps employees recognize manipulation in context. Integrating such exercises into collaboration tools themselves reinforces good habits at the point of risk.

3. Identify Learning Objectives for Modern Phishing Awareness

   A modern security awareness framework must have the following learning objectives:

   • Employees must learn to verify messages across different channels and be well aware of the psychological cues that social engineering attackers frequently use on these channels.
   • They must have clarity about the reporting mechanisms for the collaboration and communication channels they use daily.
   • They must be well-aware of the data they can and cannot share via these tools to avoid phishing attempts that trick employees.

4. Evaluating the Impact of Security Training Across Channels

   Do the metrics change while measuring the performance of your training programs? There is no marked change. The click rate, report rate, and time-to-report remain the essential benchmarks. Couple that with new metrics, such as cross-platform detection rates, which help you compare detection rates across platforms. You can also assess resilience by tracking the reduction in real incidents across platforms.

Future-Proofing Against Omnichannel Phishing Threats

Don’t build a bigger security framework; create a smarter one. This should be the defining approach to addressing omnichannel phishing threats. The focus should shift from avoiding every alert to anticipating events and addressing them before they happen (evolved security awareness and unified threat management), and securing the length and breadth of the communication fabric, not just the inbox.

You also need a zero-trust mindset, which should be the default posture: verify every user account and identity, and grant access only for essential needs, not convenience. The focus should always be on ensuring data integrity and protecting data. Every control, policy, and automation flow should start with a single principle – safeguard sensitive information wherever it lives or moves.

A future-ready security ecosystem will lean heavily on AI-driven security and the convergence of threat intelligence. This will involve detecting subtle patterns across platforms, as well as automated responses to detected threats. But more importantly, it will also be about continuous, realistic training that mirrors real-world, evolving phishing tactics. This will help build a composite security culture that learns faster than the attacks happen.

References:

[1] https://hoxhunt.com/guide/phishing-trends-report
[2] https://www.infosecurity-magazine.com/news/lazarus-bitdefender-linkedin-scam/
[3] https://www.msn.com/en-us/news/technology/new-linkedin-phishing-scam-targets-executives-with-fake-board-positions/ar-AA1PAqbK
[4] https://www.itpro.com/security/ransomware/the-scattered-spider-ransomware-group-is-infiltrating-slack-and-microsoft-teams-to-target-vulnerable-employees
[5] https://timesofindia.indiatimes.com/city/hyderabad/cyber-thugs-impersonate-greenko-md-trick-staff-into-transferring-2-7-cr/articleshow/121699681.cms