Research · Q1 2026
1,400 Ways Attackers Beat Your Email Security
We analyzed ~5,000 phishing attacks that bypassed enterprise secure email gateways. Not one-trick attacks: a mature evasion ecosystem where attackers engineer multi-technique architectures to defeat the specific stack they’re targeting.
Key findings
- 4.1evasion techniques stacked in the average attack.
- 27.8%of detections were phone-callback (TOAD) attacks: no URL, no attachment, just a phone number.
- 35.9%of attacks fell into structural blind spots that scanning the email text can’t reach.
- 34.7%of detections scored 7 or more out of 10 on regex difficulty, up from 20.1% in the prior study.
- 130%more unique technique combinations than in the prior study (Sep–Nov 2025).
The evasion landscape
22 techniques. 5 categories. 1,400+ unique combinations.
Every evasion technique serves one of three roles: it shifts the attack channel, obfuscates the payload, or exploits human psychology. Attackers don’t pick one. They stack them.
- 27.9%
Channel-shifting
Moves the attack off the email plane entirely, rendering email-only detection structurally blind.
Phone callback (TOAD) · QR code · Voicemail pivot
- 43.0%
URL evasion
Launders malicious URLs through legitimate infrastructure or actively blocks automated scanning.
Legitimate redirect · CAPTCHA gate · Multi-hop redirect · Encoded URL
- 20.3%
Content evasion
Hosts payloads on trusted platforms with perfect reputation scores no SEG will block.
LOTS hosting · PDF attachment · Image-based payload · Notification spoofing
- 0.5%
Auth evasion
Exploits authentication trust: OAuth tokens, SSO flows, and session hijacking.
Authentication exploitation · Collaboration platform spoofing
- 65.5%
Social engineering
Vocabulary identical to legitimate business communication. Detection cost exceeds miss cost.
Authority impersonation · Domain lookalike · Financial lure · Brand impersonation
Shares of all detections. One attack can use techniques from several categories, so they add up to more than 100%.
Technique stacking: the end of one-trick attacks
The average attack stacks 4.1 techniques at once. 56.8% use five or more, and only 9.1% use two or fewer.
Source: StrongestLayer Threat Research · ~5,000 email-based threat detections · Dec 2025 – Feb 2026. All detections bypassed upstream SEGs.
The headline finding
The #1 attack family has no scannable payload.
27.8%
TOAD: telephone-oriented attack delivery
More than 1 in 4 emails use a phone number as the payload. No URL. No attachment. No technically malicious content. A call center staffed by social engineers does the rest, outside the detection model email security was designed for.
TOAD showed a ~487% increase from December to January 2026: a structural shift in how attackers deliver social engineering.
- 13.2%Branded financial callbackNorton, McAfee, PayPal: specific dollar amounts feel transactional, not fabricated.
- 9.1%Financial callback (no brand)Generic payment themes. Harder for brand-matching rules to catch.
- 4.3%Generic callbackNo financial or brand signals. Pure social engineering.
- 1.1%Notification callbackMimics automated billing systems: the format itself conveys authority.
TOAD categorization validated against published research from Proofpoint, Trustwave SpiderLabs, Intel 471, and Cisco Talos.
How it works
The three-layer evasion architecture.
The most sophisticated attacks construct a layered architecture where each layer defeats a different detection capability. The combination creates a detection gap that compounds multiplicatively.
-
Layer 1: Trusted delivery
Email arrives through legitimate infrastructure: SendGrid, Google Calendar, SharePoint links, or google.com redirects.
Reputation-based filtering defeated. Perfect reputation scores no SEG will block.
-
Layer 2: Anti-scanner
Payload protected by CAPTCHA gates, encoded in QR codes inside PDFs, or delivered as image-based payloads.
Sandbox analysis defeated. The SEG follows the URL, hits a CAPTCHA, and marks it “clean.”
-
Layer 3: Channel shift
Exploitation moves off email: to a phone call (TOAD), a mobile device (QR), a Teams meeting, or SMS.
Post-delivery remediation defeated. Damage occurs in a channel the SEG cannot monitor.
35.9% of all detections fall into structural blind spots: Attack categories where SEG detection is not merely difficult but architecturally impossible within an email-text-scanning paradigm. TOAD accounts for 27.8%, QR code attacks for 6.0%, and voice channel shift for 2.1%.
The taxonomy
Attack families ranked by evasion strategy.
Classified by primary evasion strategy, not raw technique count. A TOAD attack with 2 techniques is harder for a SEG to detect than a redirect chain with 6, because the TOAD payload is structurally unblockable.
| Super-family | % of total | SEG detection difficulty |
|---|---|---|
| TOAD / phone callback | 27.8% | Structural blind spot |
| Redirect chain families | 27.4% | Hard (evasion-dependent) |
| Legitimate infrastructure (LOTS) | 16.7% | Hard (reputation-laundered) |
| Social engineering pure-play | 14.0% | Medium-hard (high false positive cost) |
| QR code attack families | 6.0% | Structural blind spot |
| Voice channel shift | 2.1% | Structural blind spot |
| Content evasion | 2.0% | Medium |
| Collaboration platform spoofing | 0.7% | Hard |
| Authentication exploitation | 0.5% | Very hard |
Platform-specific evasion
Attackers adapt to your security stack.
Evasion profiles are not random. Microsoft environments face image-based payload attacks; Google Workspace faces notification spoofing and voicemail pivots. Attackers are optimizing for the detection gaps of specific platform architectures.
Microsoft environments
- QR code
- 11–53%
- PDF attachment
- 21–43%
- Multi-hop redirect
- 17–48%
- CAPTCHA gate
- 15–38%
- Legitimate redirect
- 37–60%
- Notification spoofing
- 25–44%
Google Workspace
- Notification spoofing
- 31–59%
- Authority impersonation
- 78–82%
- Domain lookalike
- 66–77%
- Legitimate redirect
- 37–66%
- CAPTCHA gate
- 15–44%
- Voicemail pivot
- 10–34%
The platform divide: Microsoft faces image-based attacks: QR codes up to 53%, PDF attachments up to 43%. Google Workspace faces spoofed notifications up to 59% and voicemail pivots up to 34%. Attackers adapt evasion profiles to each platform’s architecture.
Share of detections using each technique. Ranges reflect variation across environments. Sample sizes are small; patterns are directional.
Unlocked. The full research is below.
Campaign intelligence
How these attacks actually work.
Anonymized real detections. Each shows how technique combinations defeat detection at each stage of the email security pipeline.
Cluster #1Difficulty 7/10
The canonical TOAD attack
Authority + brand + domain lookalike + financial lure + phone callback · 5 techniques · 3.4% of detections
An email from “Sandra” at Outlook.com. Subject: “welcome.” The body claims to be PayPal: “Your account has been upgraded. A charge of $249.99 has been applied. Call (XXX) XXX-XXXX immediately if you did not authorize this.”
| Stage | What happens | Why detection fails |
|---|---|---|
| Delivery | Email from webmail with PayPal branding, financial language, and a phone number. | No URL or attachment to scan. PayPal branding appears in millions of legitimate emails. |
| Trust | PayPal logo, color scheme, legal footer. A specific dollar amount and “business account upgrade” framing. | Brand-matching requires visual analysis. The dollar amount feels transactional, not fabricated. |
| Exploitation | The victim calls the number. A call center performs credential harvesting or gift card fraud. | The attack happens over the phone, and no email security monitors calls. Remediation cannot undo a completed call. |
Family 4A53% QR rate in Microsoft Basic
The QR triple stack
QR code + PDF attachment + CAPTCHA gate · 1.5% of detections · concentrated against Microsoft Basic
An email from “internal HR” with the subject “[COMPANY] December Bonus” contains a PDF with a QR code leading to a CAPTCHA-gated credential harvesting page.
| Stage | What happens | Why detection fails |
|---|---|---|
| Delivery | HR/payroll-themed email with a PDF attachment. No URL in the email body. | No malicious URL text for regex to match. PDF is a legitimate business document format. |
| Payload | A QR code embedded as an image inside the PDF encodes a URL to a credential harvesting page. | The URL is encoded in pixels inside an image: it takes OCR, computer vision, and QR decoding to find it. |
| Gate | A CAPTCHA blocks automated analysis of the decoded URL. | The SEG sandbox hits the CAPTCHA and cannot proceed. The URL is marked “clean.” |
| Exploitation | The victim scans the QR code on a personal phone, completes the CAPTCHA, and enters credentials. | The mobile device is outside enterprise security monitoring. Exploitation happens on an unmanaged device. |
Cluster #448% penetration vs. Microsoft E3
The multi-hop redirect chain
Authority impersonation + legitimate redirect + multi-hop redirect · 1.3% of detections
An email advertising weight-loss medication redirects through tracksmo.store → frametwistnine.com → the final harvesting page. Each hop passes reputation checks on its own. The intermediate redirect returns a benign page at scan time and switches to the malicious page at click time.
| Stage | What happens | Why detection fails |
|---|---|---|
| Delivery | Email with embedded URLs through legitimate redirect infrastructure. | First-hop URLs pass reputation checks via trusted redirect endpoints. |
| Evasion | 3+ redirect hops exceed scanner recursion depth. A benign page when scanned, a malicious one at click time. | SEG scanners follow 1–2 redirects. Chains of 3+ hops defeat time-of-click rewriting. |
| Exploitation | A credential harvesting page that only activates after the scan window closes. | Safe Links’ 48% E3 penetration suggests attackers engineer redirect chains to evade time-of-click rewriting. |
Cluster #10
The internal impersonation attack
Authority impersonation + domain lookalike + legitimate redirect · 1.0% of detections
An email from dsmgroup.cl with the subject “[COMPANY-B] Please confirm your account Verification.” The sender shows the target company’s name. A “Continue” button redirects through multiple domains to navco.in, a credential harvesting page.
| Stage | What happens | Why detection fails |
|---|---|---|
| Trust | The sender name matches the victim’s own company. The subject references account verification, a routine IT workflow. | Completely plausible. The only signal is the mismatch between sender name and sender domain. |
| Evasion | Multiple redirect hops through different domains before reaching the harvesting page. | Sender-brand correlation is contextual intelligence most SEGs don’t perform. |
Cluster #36 techniques
The fully loaded notification TOAD
Authority + brand + domain lookalike + financial lure + notification spoofing + phone callback · 1.8% of detections
Subject: “The $349.74 USD order is currently being activated.” Sender: “Segundo B” from colegiodonvasco.edu.mx. The email is a Norton billing notification with an order number, a transaction ID, and a callback number.
| Stage | What happens | Why detection fails |
|---|---|---|
| Trust | Automated system notification format. Order numbers and transaction IDs add bureaucratic credibility. | Recipients are conditioned to trust automated notifications from hundreds of legitimate services. |
| Evasion | An educational domain (.edu.mx) claiming to be Norton. No brand-matching logic connects them. | Connecting an .edu.mx domain to a Norton billing alert requires sender-brand correlation most SEGs don’t perform. |
| Exploitation | A phone callback to the provided number leads to social engineering. | The same TOAD structural blind spot. The attack exits email before any harm occurs. |
Where email security cannot follow
Three tiers of architectural limitation.
- 35.9%
Structurally impossible
These attacks move the malicious action off the email plane entirely. No email-centric security solution can detect, block, or remediate the harm, because it occurs in a channel the SEG cannot monitor.
TOAD (27.8%) · QR code (6.0%) · Voice channel shift (2.1%)
- ~20%
Practically defeated
CAPTCHA-gated attacks across all families. The SEG sandbox encounters the CAPTCHA and cannot proceed: the attacker is detecting the detector and blocking it.
CAPTCHA gates across all attack families
- ~44%
Prohibitive false positive cost
Legitimate redirect abuse (43.0%), financial lure (44.1%), authority impersonation (65.5%). These techniques succeed because their vocabulary is identical to legitimate business communication.
Blocking “invoice” + “payment” would paralyze accounts payable
Why endpoint detection doesn’t close the gap
EDR products (Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne) detect malicious code execution on managed endpoints. The evasion patterns here are engineered to avoid the endpoint entirely.
TOAD: never touches the endpoint
The victim calls a phone number. Credential harvesting, remote access installation, gift card fraud: all of it happens over the phone. EDR sees nothing: no file execution, no process creation, no network indicator of compromise.
QR codes: unmanaged devices
QR code attacks (up to 53% in Microsoft environments) shift exploitation to personal smartphones. EDR sees the PDF opened. It cannot see the phone scanning the QR code, navigating the CAPTCHA, or entering credentials on an unmanaged device.
The detection stack gap: Email security operates at the gateway. EDR operates at the endpoint. These evasion patterns exploit the gap: they pass through the gateway without a signal, then execute through channels (calls, personal devices, browser sessions) the endpoint cannot monitor.
The DocuSign-SendGrid nexus
DocuSign, at 24.8%, is now the most impersonated brand. Attackers use the same SendGrid infrastructure as the real DocuSign, which makes them structurally indistinguishable at the email header level.
| Brand ecosystem | % of total |
|---|---|
| DocuSign | 24.8% |
| Microsoft | 11.7% |
| 10.7% | |
| Norton / McAfee / Geek Squad | 10.6% |
| SendGrid | 8.2% |
| PayPal | 5.9% |
| Amazon / AWS | 5.9% |
| Meta / Facebook | 5.4% |
| Shipping (USPS / UPS / FedEx / DHL) | 3.6% |
66.2% of all detections reference an identifiable brand.
The implication
If attackers evolved, so must detection.
Attackers: before
Single-technique attacks
- One phishing link per email
- Detectable by URL scanning
- Blocked by reputation filters
Attackers: now
Personalized kill chains
- 4.1 techniques per attack, stacked by design
- Platform-specific evasion profiles
- 35.9% in structural blind spots
Defenders: before
Context-less alerts
- Pattern-matched flags
- No cross-signal correlation
- Single-layer scanning
Defenders: now
Full kill chain reasoning
- Fully identified and reasoned cases
- Complete kill chain analysis per email
- Semantic understanding, not pattern matching
They went from single techniques to personalized kill chains. We went from context-less alerts to fully reasoned cases with complete kill chain analysis.
What you can do about it
See what’s getting past your email security.
This research is based on real enterprise environments. The evasion patterns hitting your organization are specific to your platform, your SEG, and your industry.
Threat briefing
Walk your security team through the full findings. We’ll present the research, answer questions, and map it to your environment. No commitment.
Book a threat briefing →Threat assessment
See which evasion patterns are getting past your current email security. We’ll run a proof of concept against your live traffic and show you your specific blind spots.
Request a threat assessment →Methodology
- Sample
- ~5,000 attacks
- Period
- Dec 2025 to Feb 2026
- Taxonomy
- 22 evasion techniques across five categories
- Source
- StrongestLayer customer detections
Cite this report
StrongestLayer Threat Lab. "1,400 Ways Attackers Beat Your Email Security." Q1 2026. ~5,000 attacks. https://www.strongestlayer.com/threat-lab/email-evasion-taxonomy