When the Obvious Gets Through

What a phishing campaign reveals about the limits of email security

There is something particularly concerning about a phishing email that manages to bypass an organisation's email security defences when it carries the kinds of warning signs that security professionals have spent years teaching people to recognise.

It raises an uncomfortable question: if the obvious can get through, how confident should businesses really be in the protection sitting between their employees and their inboxes?

That question was brought into focus by a recent report from Dark Reading, which detailed a phishing campaign impersonating artificial intelligence company Anthropic. According to the report, the campaign involved fraudulent early-access invitations designed to steal Google and Microsoft account credentials.

What makes the incident noteworthy is not simply the impersonation of a high-profile technology brand. It is the reported ability of the emails to evade established email security controls, including deployments of some leading Secure Email Gateways (SEGs) and Microsoft Defender for Office 365.

The campaign contained several features that, viewed in isolation, might have raised suspicion:

• an unrelated sender address,

• a shortened URL,

• a misspelt sender display name, and

• a relatively basic-looking message.

• The attackers also used CAPTCHA challenges designed to frustrate automated scanning and security analysis.

These techniques are not necessarily sophisticated in themselves. But they illustrate a persistent challenge for email security: attackers do not need to invent an entirely new way to deceive people if they can find a way to get a familiar-looking scam past the systems intended to stop it.

And that is where the wider issue begins.

A recognised brand is not a security guarantee

For many organisations, choosing an email security solution is influenced by familiarity. Large, established technology brands are often perceived as the safe choice. Their market presence, reputation and extensive product portfolios can create confidence that their security capabilities will be equally comprehensive.

There is also a growing tendency to consolidate technology suppliers. For organisations already operating within the Microsoft ecosystem, using Microsoft security products can appear to be the logical next step. Fewer vendors can mean simpler procurement, administration, integration and supplier management.

There are legitimate business reasons to pursue consolidation. But convenience and security performance are not the same thing.

The question organisations should be asking is not simply whether their email security comes from a recognised provider, or whether it is convenient to bundle it with other services. It is whether that protection is consistently identifying and stopping the threats targeting their people and business.

The Dark Reading report does not establish that every customer of Microsoft or the other SEGs is exposed, nor does one campaign provide a comprehensive assessment of either provider's overall effectiveness. It does, however, offer a timely reminder that even widely adopted security products can have blind spots.

No organisation should assume that a vendor's reputation is a substitute for evidence of performance.

The changing nature of email threats

Email remains an attractive attack channel because it exploits something that technology alone cannot easily eliminate: human trust.

A convincing message can prompt an employee to open an attachment, follow a link, disclose credentials or approve a payment. The attacker may not need to compromise the organisation's network directly. They may only need one person to believe that a message is legitimate.

And the appearance of a phishing email is no longer a reliable indicator of how dangerous it might be.

Some attacks are crude and contain obvious spelling mistakes, suspicious links or implausible requests. Others are carefully constructed to imitate trusted suppliers, colleagues, executives and well-known brands. Business Email Compromise (BEC), supplier impersonation and credential-harvesting attacks can be particularly difficult to identify because they are designed around familiar business processes and relationships.

Attackers also continue to adapt their techniques to frustrate security controls. They can manipulate links, alter message content, use legitimate services as part of their delivery infrastructure and vary the appearance of messages across a campaign.

The Anthropic-themed campaign reported by Dark Reading is a useful example. Its use of a legitimate GoTo Webinar sender address and CAPTCHA challenges demonstrates how attackers can introduce elements that complicate automated inspection and make a message harder to assess.

The report also raises the possibility of AI-assisted campaign creation, although it does not confirm that generative AI was used in this incident. That distinction matters. The broader lesson is not that every new phishing campaign is AI-generated, but that attackers continually adapt, and security controls must evolve with them.

Email security cannot stand still

A modern email security solution needs to do more than recognise yesterday's malicious attachments and known phishing links.

It needs to assess multiple signals, understand context, identify suspicious behaviour and respond to emerging attack patterns. It must be capable of identifying both familiar threats and variations that have not previously been seen.

That requires a layered approach. Different detection techniques bring different strengths, and relying too heavily on a single method can leave gaps.

With MailGuard, this philosophy is reflected in a security architecture developed through more than 25 years of specialist email security engineering. Its detection approach combines proprietary AI and machine learning models, semantic analysis, threat intelligence, behavioural signals, rules and heuristic detection. These models work together through a proprietary orchestration engine to assess threats from multiple perspectives.

The objective is to identify malicious intent and suspicious patterns, not simply match an email against a list of previously identified threats.

This distinction is increasingly important as attacks become more targeted and convincing. A fraudulent message may contain no malicious attachment, and its link may not yet appear on a blocklist. It may instead rely on impersonation, unusual communication behaviour or a carefully engineered request.

Effective protection must account for those possibilities.

Technology is only part of the equation

There is another consideration that can be overlooked when organisations evaluate email security: the people behind the technology.

Security platforms are not simply installed and forgotten. Organisations have different communication patterns, supplier relationships, user behaviours, risk profiles and operational requirements. Their security arrangements need to reflect those differences.

A solution that is not appropriately configured, monitored and optimised may not deliver the protection an organisation expects. And when a new threat emerges or something unusual happens, access to knowledgeable security professionals can make a meaningful difference.

This is why the service and expertise behind an email security platform deserve as much scrutiny as the technology itself.

MailGuard is supported by a team of cybersecurity experts available 24/7 to assist customers, investigate issues and help optimise protection for their particular circumstances. Its approach also combines automated detection with human-led threat intelligence and validation, recognising that technology provides scale and speed while experienced security professionals bring contextual judgement.

For organisations evaluating their email security arrangements, this raises a useful question: does your provider simply supply a technology platform, or does it actively support you in making sure that platform continues to perform?

Questions every organisation should be asking

The lesson from the Anthropic-themed phishing campaign is not that one vendor should automatically be chosen over another. Nor is it that organisations should abandon consolidated technology environments.

It is that security decisions deserve more scrutiny than brand recognition or purchasing convenience alone.

When reviewing an existing email security solution, organisations should consider asking their provider some direct questions:

• What is actually being detected? Ask for meaningful reporting on the threats being intercepted, including phishing, impersonation, credential harvesting and business email compromise.
• How quickly are new threats identified? Detection speed matters. A threat that is eventually identified may already have reached employees and caused harm.
• How does the solution handle unfamiliar attacks? Ask how it identifies suspicious messages that do not match known signatures, malicious URLs or established threat patterns.
• How is protection adapted to our organisation? Understand how configuration, policies and detection are tuned to reflect your business, users and risk profile.
• What expertise is available when we need it? Find out whether experienced cybersecurity specialists are accessible, how they support incident investigation and whether they proactively help optimise security performance.
• What evidence demonstrates that the solution is working? Look beyond product claims. Request reporting, examples and meaningful insight into the threats being stopped and the risks that remain.

These questions are relevant whether an organisation uses a specialist email security provider, a broader cybersecurity platform or the security capabilities bundled with its existing productivity environment.

The real test is what gets stopped

The email security market is crowded with established brands, extensive feature lists and increasingly sophisticated claims about artificial intelligence and threat detection.

But the real test of any security solution is not how familiar its name is, how many features appear on its website or how conveniently it fits into an existing technology agreement.

It is how well it performs when a real threat arrives.

The campaign reported by Dark Reading is a timely reminder that organisations should not confuse market reputation with guaranteed protection. Even messages containing warning signs can find their way through established defences. And as attackers continue to adapt, businesses cannot afford to treat email security as a procurement decision they make once and never revisit.

The question is not whether your organisation has email security. It is whether that security is doing the job you believe it is doing.

When the obvious gets through, it is time to ask some harder questions.

Talk to our team

Reach out to speak to a GlobalGuard expert about securing your inboxes against advanced, malicious email-borne threats with our AI-powered email security solutions.