How Phishing Bypasses Email Filters and How to Protect Your Organisation

Key takeaways

• Filters judge sender reputation, authentication and known-bad content. A hijacked real account passes all three.
• The usual lure is a fake quarantine, password-expiry or shared-document alert that links to a credential-harvesting page.
• Delayed or conditional activation lets the page look clean when scanned and malicious when a person clicks.
• Phishing-resistant MFA (passkeys, FIDO2 keys) is the strongest single control, because a stolen password alone is no longer enough.
• Treat every reported phish as a possible compromised partner and tell them quickly.

How does this kind of phishing work?

The attacker first takes over a genuine mailbox at one organisation, often through an earlier phishing success. From that account they email that company's contacts: customers, vendors, colleagues. The message looks like a Microsoft 365 or Google Workspace notice such as "You have 5 messages in quarantine" or "Your password expires today". The button opens a page that copies the real sign-in screen and passes the credentials to the attacker.

We are describing a pattern that security vendors and CERTs have reported repeatedly, not one named campaign. We have not tied this page to a single sample or actor, so treat the details as typical behaviour to test against your own mail logs.

Why do email filters miss it?

What are the warning signs?

• A "system" notice that arrives from an external person's address, not from your own IT tool.
• Urgency about a deadline, quarantine or account closure.
• A link whose real destination, shown when you hover, is not your sign-in domain.
• A sign-in page that appears after a redirect, or asks for your password again right after you just signed in.
• A reply-chain email that suddenly changes tone or asks for credentials or payment details.

How to protect your organisation

1. Use phishing-resistant MFA. Passkeys and FIDO2 security keys bind the login to the real website, so a fake page cannot reuse them. SMS codes and push approvals can be relayed by attacker proxies.
2. Add conditional access. Require managed or compliant devices and block risky sign-ins from unusual locations.
3. Rewrite and re-scan links at click time, not only at delivery.
4. Publish DMARC at enforcement for your own domain so attackers cannot spoof you, and add external sender banners.
5. Give staff a one-click report button and thank them for using it, even for false alarms.
6. Hunt for sign-ins and inbox rules. Attackers often create hidden forwarding or delete rules. Alert on new rules and impossible-travel logins.
7. Prepare a takeover playbook: reset the password, revoke sessions and tokens, remove rogue rules, check sent items and notify the affected partners.
8. Train with realistic exercises built from your own incidents, and measure reporting speed, not only click rate.

What if someone already entered their password?

Act within minutes. Reset the password from a clean device, revoke all active sessions and refresh tokens, and check the mailbox for new forwarding rules and sent items. Review audit logs for the hours after the click. In India, serious incidents can be reported to CERT-In. The MITRE ATT&CK framework lists phishing and valid-account techniques that help you map detections.

Common mistakes

• Believing a passing SPF, DKIM and DMARC result means an email is safe. It only proves who sent it, not whether they are trustworthy.
• Training users to "check the sender" when the sender is real.
• Relying on SMS or push MFA for high-risk accounts.
• Not warning the compromised partner, which lets the same account keep phishing others.

Related reading: spear phishing examples and prevention, AI-generated phishing emails and social engineering countermeasures.

Next steps

Next steps: to learn how defenders detect and respond to this, see our SOC Analyst course, and read about spear phishing prevention.