Threat Actors Advancing Email Phishing Attacks to Bypass Security Filters

Cybercriminals are evolving their email phishing arsenals to slip past automated filters and human scrutiny, with the latest tactics layering on novel evasion techniques. The piece notes that in 2025 attackers continued to employ password-protected attachments and calendar invites, but now also embed QR codes inside PDFs and deploy multi-stage verification chains and live API integrations to prolong attack lifecycles.

A revived emphasis on calendar-based phishing targets business-to-business campaigns, where a blank email and a calendar invite can lead recipients to click malicious links days later. The approach also includes sophisticated MFA bypass methods, such as live-proxy techniques that proxy interactions to the real service, enabling attackers to harvest one-time codes alongside passwords.

The article, published on 22 October 2025, cites that these refinements exploit gaps in scanning tools and user trust in ostensibly legitimate security measures, urging organisations to treat unusual attachments with scepticism and to verify links and domains before clicking. According to Securelist, these developments reflect a broader trend of retro methods revived with modern deception to defeat defences.