For years, most anti-phishing efforts focused on email.
Filtering technologies improved, employees received security awareness training, and organizations invested heavily in detecting suspicious messages before they reached users’ inboxes.
But while everyone was focused on email, attackers started looking for other ways to reach their targets.
Today, more and more attacks begin through everyday platforms such as Microsoft Teams, Slack, WhatsApp, LinkedIn, and even Zoom.
From the attackers’ perspective, the shift makes perfect sense. Employees have become more cautious when it comes to email. They check sender addresses, think twice before clicking links, and are generally more aware of phishing risks.
A message received through a trusted collaboration platform, however, is often perceived as more legitimate.
When a message arrives through Teams, the user is already inside their work environment. They are less likely to expect an attack, less likely to question the source, and more likely to respond quickly as part of their normal workflow.
That is exactly why attackers are shifting their focus to these channels.
Their objective has not changed. They still want users to click, log in, approve an action, or share sensitive information.
What has changed is where the conversation begins.
As a result, the challenge is no longer just protecting email.
The challenge is protecting users wherever they work and communicate.
Because phishing has not disappeared.
It has simply left the inbox.
