Phishing grew up. Most defences are still fighting the last war.

The word "phishing" still conjures a familiar mental image for most people: a poorly worded email from an unknown sender, full of red flags, easy to spot and delete. That image is dangerously out of date — and holding onto it is making organisations measurably less safe.

Modern phishing attacks are precise, personalised, and often invisible until it's too late. They don't rely on fooling the careless. They're engineered to fool the careful.

What a modern attack chain looks like

Here's what a typical attack chain looks like now:

Target Profiling → Lure Crafting → Delivery → Trust Establishment → Credential Harvest / Payload → Lateral Movement

The first two steps — target profiling and lure crafting — are where the sophistication has exploded. Attackers scrape LinkedIn, company websites, and public calendars to build context before sending a single message. They know your employee's manager's name, the project they're working on, and the tools your organisation uses. With AI, this entire profiling and drafting process can be completed in hours. The lure that arrives looks exactly like it belongs.

Key insightWith AI tools, attackers can research a target, build a convincing lure, and launch — in hours. The window to detect that something is coming has never been smaller.

Phishing isn't just email anymore

Think about receiving a message that references your actual project name, uses your manager's first name, and asks you to review a shared document before a meeting in 20 minutes. You're mid-task, slightly rushed. The link resolves to what looks exactly like your organisation's login portal. That's not an easy situation to navigate correctly — and it's not theoretical. It's the standard playbook.

Phishing has also expanded well beyond email. CISA advisories have flagged the rise of multiple delivery channels operating in parallel:

Vector	What It Looks Like	Why It's Growing
Spear phishing email	Personalised — references manager names, live projects, internal tools	AI dramatically reduces the time to research and craft believable lures
Smishing (SMS)	Fake delivery alerts, urgent re-authentication requests via text	SMS bypasses corporate email filters entirely
Vishing (voice)	Caller impersonates IT support, a vendor, or an executive	AI voice cloning makes impersonation increasingly convincing
QR code phishing	Embedded in email or print; routes victim to a credential page	Bypasses email link-scanning; users scan on personal devices with fewer controls
Adversary-in-the-middle (AiTM)	Intercepts the session between user and real login page in real time	Captures session tokens, bypassing MFA entirely

CISA's 2023–2024 phishing advisories flagged the rapid expansion of QR code phishing and AiTM campaigns as vectors that specifically outpace traditional email-based defences. Each exploits a different gap — in email filters, in MFA assumptions, in the limits of human attention.

Key insightMFA is essential — but attackers have already adapted. Session-token interception bypasses it without ever touching your password.

Sophistication, meet scale

The scale alongside the sophistication is what makes this hard. The Anti-Phishing Working Group has documented record-high phishing volumes through 2023–2024, with millions of unique attacks reported per quarter. Verizon's 2024 DBIR placed phishing among the top three initial access techniques across breach categories.

The implication for defenders is uncomfortable: the more contextually convincing the attack, the more it depends on a human making the right call at the right moment — under time pressure, while distracted, in the flow of a normal workday. Technical controls matter, but they're increasingly the second line of defence, not the first.

Key insightThe cost of empowering employees to catch threats early is a fraction of the cost of recovering from a breach — even one your team handles well. Lost productive hours, business interruption, system downtime, data exposure, customer trust to rebuild: those costs accumulate fast, and they accumulate whether or not you contained the incident.

What the first line of defence looks like now

At Mungo Labs, we're building tools that put employees in a position to be that first line of defence — not by expecting them to be perfect, but by giving them the right context at the right moment and a frictionless path to flag something when it feels off. Because if the only signal a security team has is "the breach already happened," the timeline has already failed.

Where to start

Whatever tools your organisation uses, one step is worth taking now: make it easier to report than to ignore. A culture where employees surface near-misses is worth more than any simulation metric. That's where real detection starts — long before any alert fires.

← Back to all posts