StrongestLayer Threat Research · The Definitive Taxonomy

Email attacks outgrew phishing and BEC. 99% of defenses still stop there.

Methodology: 5,000 detections across enterprise environments, December 2025 to February 2026. Trajectory tags reflect Q1-Q2 2026 incident data weighted by frequency and measured financial impact.

A map of 44 email attack subtypes across 6 categories, every one fully simulated as an interactive kill chain. 35.9% of what lands in inboxes today is structurally impossible to block at the email layer. Every email security product is a combination of five detection technologies, and only one was designed for attacks that chain three evasion layers together.

44 attack subtypes

44 interactive simulations

22 evasion techniques seen in our data

April 2026

Jump to the 44-subtype grid →

For prevalence data and the full technique breakdown, see the February 2026 research paper.

The Taxonomy

44 attack subtypes. Tagged by 2026 trajectory.

Each of the 44 subtypes is fully simulated as an interactive kill chain. Click any cell to open the live walkthrough. Each card also carries a sparkline showing whether the attack is rising, holding, or falling in 2026 incident data. The Top 2026 band below highlights the eight attacks driving the most enterprise impact right now.

8 attacks driving 2026 incidents

Highest-incidence, highest-impact attacks scored by Q1-Q2 2026 enterprise data. Click any card to jump to its simulator.

2026 Trajectory

All 44

Top 2026 8

Increasing 9

Stable 21

Decreasing 5

Rare 1

Cross-cut

Pattern Matching Weak

Behavioral ML Weak

AI-Elevated

AI-Era Threats

Methodology. Trajectory tags are based on incident frequency and measured financial impact in Q1-Q2 2026 data, weighted equally with attacker investment required. Where our researcher and external vendor reports disagreed on direction, we averaged to Stable rather than picking a side. AI-Elevated flags attacks where generative AI removed the grammar and procedural-error tells that traditional detection used to catch.

All 44 attack subtypes

Credential Harvesting

1.1 Standard Phishing: Email impersonating a known brand requesting the recipient click a link and log in.
1.2 Spear Phishing: Uses specific knowledge about the recipient. The lure is tailored to the individual.
1.3 Whaling: Spear phishing directed at C-suite or board-level individuals. References board meetings, M&A activity.
1.4 AiTM Phishing: Link routes through a reverse proxy between victim and real auth service. Victim completes MFA. Proxy captures credentials and session cookie.
1.5 Quishing (QR Code): QR code image rather than clickable URL. Destination URL encoded in image, invisible to email scanners.
1.6 OAuth / Consent Phishing: Link triggers a legitimate OAuth authorization flow. Victim grants permissions to a malicious app on a legitimate identity platform.
1.7 Helpdesk Social Engineering: Attacker impersonates employee to IT helpdesk. Goal: password reset, MFA removal, attacker-controlled device.

Malware Delivery

2.1 Macro-Enabled Documents: Office file prompts Enable Content. Macro downloads and runs second-stage payload.
2.2 Container File Delivery: Archive containing a Windows shortcut (LNK) and decoy document. LNK invokes PowerShell or MSHTA.
2.3 HTML Smuggling: HTML file assembles binary payload client-side via JavaScript. Gateway sees clean HTML; payload never transmitted as recognizable file.
2.4 Malicious Link (Drive-By): URL pointing to externally hosted malware or exploit page. Geofenced and time-delayed payloads defeat scan-time analysis.
2.5 PDF Exploit / Malicious Link: PDF attached as plausible business document containing embedded exploit, malicious link, or QR code.
2.6 Malspam (Botnet-Driven): High-volume spam distributing malware via attachment or link. Not targeted, relies on volume.

Business Email Compromise

3.1 CEO Fraud: Email from a senior executive to finance requests urgent wire transfer to new account framed as confidential deal.
3.2 Vendor / Invoice Fraud: Email impersonating known vendor requesting payment to a new bank account. Modified PDF invoice.
3.3 Payroll / HR Diversion: Email impersonating employee to HR/payroll requesting direct deposit change. New account typically a prepaid card.
3.4 Account Takeover BEC: Attacker operates from legitimately compromised email account. Creates inbox rules to suppress alerts.
3.5 Thread Hijacking: Fraudulent message inserted into existing legitimate email thread. Thread history provides real context.
3.6 Attorney / Legal Impersonation: Email from purported legal counsel or regulatory authority. References confidential legal matter or imminent deadline.
3.7 Data Harvesting BEC (W-2): Email impersonating executive to HR/finance requesting bulk employee data: W-2 forms, salary info, SSNs.
3.8 Real Estate Closing Fraud: Attacker monitors real estate transaction. At closing, inserts updated wire transfer instructions.
3.9 Gift Card Fraud: Email from executive requests employee purchase gift cards and send back numbers/PINs.
3.10 TOAD / Callback BEC: Email contains callback phone number and pretext. Decisive social engineering occurs on the phone call.
3.11 Multi-Persona Consensus: Multiple fake identities in same thread: fake executive, fake legal, fake partner. Social proof from multiple apparent authorities.
3.12 Deepfake-Augmented BEC: Email initiates contact. Decisive social engineering via synthetic audio or video.
3.13 Supply Chain Pivot BEC: Attacker compromises vendor/partner email and uses it to attack their customers.
3.14 Contact Info Update Fraud: Email impersonating vendor finance announcing updated banking details.
3.15 Advance Fee Fraud (Targeted): Financial opportunity requiring small upfront payment.

Spam / Bulk Fraud

4.1 419 / Advance Fee (Mass): Mass email offering large financial reward contingent on small upfront fee.
4.2 Counterfeit / Fake Pharmacy: Solicitation for counterfeit goods or unlicensed pharmaceuticals.
4.3 Pump-and-Dump / Investment: Mass email promoting low-value asset. AI-generated analyst reports add credibility.
4.4 Sextortion / Blackmail: Claims compromising video. Demands cryptocurrency. Often includes real password from breach data.
4.5 Fake Employment: Fraudulent job offer: advance fee or money mule recruitment.
4.6 Romance Scam (Pig Butchering): Initiates romantic relationship over weeks/months before financial requests. Leads to fake crypto platform.
4.7 Malvertising / Fake Notification: Mass email impersonating delivery service, bank, or government agency.

Disinformation

5.1 Fabricated Document Distribution: Forged contracts, financial statements, board resolutions with correct letterhead.
5.2 Narrative Seeding: Coordinated email campaign distributing false or misleading narratives. Content often partially true.
5.3 Authority Impersonation: Email impersonating government agency (IRS, FDA, SEC, CISA) or law enforcement.
5.4 Market Manipulation: Fabricated analyst reports, false earnings previews, fake regulatory approvals targeting financial sector.

Infrastructure Abuse

6.1 Account Hijack for Downstream: Compromised account sends phishing/BEC/malware to the owner's contacts.
6.2 Mail Server Relay Abuse: Misconfigured or compromised mail server used as relay.
6.3 Domain Reputation Hijacking: Attacker registers expired domains with established reputation. Domain history defeats new-domain filters.
6.4 Botnet-Driven Spam Infra: Large network of compromised devices distributing email at volume.
6.5 Legitimate Service Abuse: Attacker uses SendGrid, Mailchimp, Amazon SES, SharePoint, OneDrive to deliver malicious content. DKIM/SPF pass.

Free AI gap check

Do you have an AI gap? Find out what’s getting through.

See which generations of defense you’re running and what it takes to close the gap. Two minutes. No signup. Nothing changes in your environment.

Book a demo Find my AI gap →