Microsoft's latest threat intelligence shows that email attacks are becoming smarter, more personalized and increasingly powered by artificial intelligence.
For nearly three decades, email has been the preferred gateway for cybercriminals. From the "ILOVEYOU" worm and Nigerian prince scams to ransomware-laden attachments and credential-stealing phishing campaigns, attackers have consistently exploited the one business application every employee uses every day.
Yet despite billions of dollars invested in secure email gateways, spam filters, endpoint protection and employee awareness training, email continues to be the most effective route into enterprise networks.
The reason is simple: attackers have changed faster than enterprise defenses.
According to Microsoft's Email Threat Landscape Q2 2026 report, cybercriminals are no longer relying on poorly written phishing emails or malicious attachments to compromise organisations. Instead, they are combining artificial intelligence, legitimate cloud services, trusted identities and sophisticated social engineering to bypass traditional security controls. The inbox is no longer merely a place to deliver malware—it has become the starting point for attacks that target identities, cloud applications and business processes.
The report arrives at a time when enterprises worldwide are accelerating AI adoption while simultaneously facing an unprecedented rise in identity-based attacks. Security teams are discovering that technologies designed to stop yesterday's email threats often struggle against campaigns that use AI to mimic executives, hijack business conversations and exploit trusted cloud platforms.
For Indian enterprises, where hybrid work, cloud migration and digital transformation have become strategic priorities, the findings serve as another reminder that email security can no longer be viewed as a standalone technology. It has become a critical component of enterprise identity security.
PHISHING GROWS UP IN THE AGE OF AI
Phishing has long been considered cybersecurity's oldest trick. Traditionally, it relied on volume rather than sophistication— millions of generic emails promising lottery winnings, fake invoices or banking alerts, hoping that a small percentage of recipients would take the bait.
Artificial intelligence has dramatically changed that equation.
Microsoft's threat intelligence indicates that attackers are increasingly using AI to create convincing emails that mirror corporate writing styles, adopt flawless grammar and tailor messages for specific industries, regions and even individual employees. Instead of broadcasting identical messages to thousands of users, attackers can now generate highly personalised lures in seconds.
This has lowered both the cost and the skill required to launch sophisticated phishing campaigns.
Security researchers say AI-generated content is making it harder for employees to distinguish fraudulent messages from legitimate business communications. Emails impersonating senior executives, suppliers or customers no longer exhibit the grammatical mistakes and awkward phrasing that traditionally served as warning signs.
Attackers are also exploiting information available through company websites, professional networking platforms and social media to personalise their messages. A procurement manager may receive an email referencing an ongoing supplier contract, while an HR executive may be targeted with what appears to be a genuine recruitment inquiry. The objective is not simply to deceive users but to make malicious communications blend seamlessly into everyday business operations.
The evolution extends beyond email content. Microsoft observed phishing campaigns increasingly employing QR codes, CAPTCHA pages and multiple browser redirects before presenting victims with credential-harvesting websites. These techniques are specifically designed to evade automated email scanning systems that inspect links and attachments before messages reach employees.
In effect, attackers are exploiting the same cloud services and web technologies that enterprises rely on for everyday business.
BUSINESS EMAIL COMPROMISE ENTERS A NEW PHASE
Perhaps the most worrying trend highlighted by Microsoft's research is the continued evolution of Business Email Compromise (BEC)—a form of cybercrime that relies on deception rather than malware.
Unlike conventional phishing attacks, BEC campaigns often involve no malicious software whatsoever. Instead, attackers compromise or impersonate trusted business identities to manipulate employees into transferring funds, modifying payment instructions or disclosing sensitive corporate information.
According to the FBI, BEC remains among the costliest forms of cybercrime globally, accounting for billions of dollars in reported financial losses over the past decade. Microsoft's latest observations suggest that AI is making these attacks significantly more convincing.
Rather than sending a fraudulent invoice out of the blue, attackers increasingly spend weeks monitoring email conversations, studying communication styles and understanding business relationships before inserting themselves into legitimate discussions. AI enables them to imitate writing patterns, maintain natural conversations and respond intelligently to follow-up questions, reducing the chances that employees will suspect foul play.
This shift reflects a broader change in attacker priorities.
Instead of compromising thousands of users with commodity malware, criminal groups are increasingly focusing on high-value targets such as finance executives, procurement managers, payroll administrators and senior leadership teams. A single successful compromise of a corporate finance function can yield millions of dollars—far more than traditional mass phishing campaigns.
The challenge for defenders is that BEC attacks frequently bypass conventional security controls. Since the emails often originate from legitimate or compromised accounts and contain no malware, they appear perfectly normal to many security products.
As enterprises automate financial workflows and expand digital collaboration with suppliers and partners, the opportunities for attackers continue to multiply.
IDENTITY REPLACES MALWARE AS THE PRIMARY TARGET
For much of the last two decades, cybersecurity strategies centred on protecting endpoints against malicious software.
Today, attackers increasingly care less about infecting devices than about stealing identities.
This is perhaps the most significant trend emerging from Microsoft's latest threat intelligence.
Modern phishing campaigns are increasingly designed to harvest Microsoft 365 credentials, authentication tokens, browser session cookies and other forms of digital identity rather than simply delivering malware. Once attackers obtain legitimate credentials, they can often access cloud applications, email systems and collaboration platforms without triggering traditional security alarms.
This represents a fundamental shift in enterprise security.
Historically, an attacker needed to exploit vulnerabilities in operating systems or applications to gain access to corporate networks. Today, logging in with stolen credentials often achieves the same objective.
The consequences extend far beyond email.
A compromised Microsoft 365 account may provide access to Teams conversations, SharePoint repositories, OneDrive documents, calendars, customer records and confidential business correspondence. If the compromised account belongs to an administrator or executive, the impact can be considerably greater.
Microsoft notes that attackers are increasingly chaining together multiple techniques—credential theft, session hijacking, token abuse and cloud identity compromise— to establish persistent access without deploying traditional malware. Such attacks can remain undetected for extended periods because they closely resemble legitimate user activity.
This evolution explains why identity has become the new security perimeter.
Security technologies that focus exclusively on blocking malicious files or suspicious URLs are no longer sufficient. Organisations now require continuous identity monitoring, behavioural analytics and context-aware authentication capable of distinguishing legitimate users from compromised accounts.
The challenge is particularly acute for enterprises embracing hybrid work. Employees routinely access corporate applications from multiple devices, locations and networks, making it more difficult to determine whether unusual login activity represents legitimate business or an active cyberattack.
DEFENDING WITH AI: FIGHTING FIRE WITH FIRE
If artificial intelligence has become the cybercriminal's most powerful weapon, it is also emerging as one of the defender's most effective tools.
Security operations centres today process billions of events every day. Human analysts simply cannot investigate every suspicious login, email or endpoint alert manually. AI is increasingly helping bridge that gap.
Microsoft's security platforms now use AI to correlate seemingly unrelated signals—an unusual login, a suspicious email, an abnormal file download and a privilege escalation attempt—into a single incident that analysts can investigate. Other cybersecurity vendors are pursuing similar approaches, using AI to reduce alert fatigue and accelerate incident response.
The next frontier is autonomous security.
Rather than merely identifying suspicious behaviour, AI-powered security systems are beginning to take action automatically. They can isolate compromised accounts, revoke stolen session tokens, block risky logins, quarantine emails and initiate investigations before analysts even become aware of the incident.
This represents a significant shift in cybersecurity operations.
Just as attackers are using AI to automate reconnaissance and phishing campaigns, defenders are increasingly deploying AI to automate detection, triage and response. The contest is becoming less about who has more analysts and more about whose AI learns and adapts faster.
However, security experts caution that AI is not a silver bullet. Poorly configured AI systems can generate false positives, while sophisticated attackers continue to experiment with techniques designed to manipulate or evade AI-based detection. Human oversight remains essential, particularly for high-impact business decisions.
WHAT INDIAN ENTERPRISES MUST DO NOW
For Indian organisations, the implications extend beyond deploying another email security product.
Digital transformation has dramatically expanded the enterprise attack surface. Cloud- first strategies, hybrid work, SaaS adoption and the widespread use of AI assistants have created new opportunities for attackers while simultaneously increasing the importance of identity security.
Sectors such as banking, financial services, manufacturing, healthcare, IT services and government are particularly exposed because they process large volumes of sensitive information and routinely interact with global partners.
The response, security leaders argue, should focus on strengthening identity rather than simply adding more layers of email filtering.
That starts with adopting phishing- resistant authentication methods such as passkeys and hardware security keys, replacing SMS-based authentication wherever possible. Multi-factor authentication remains essential, but organisations are increasingly recognising that not all forms of MFA provide the same level of protection against modern attacks.
Identity governance is another priority. Enterprises need tighter controls over privileged accounts, continuous monitoring for abnormal login behaviour and automated mechanisms to revoke access when risk levels change.
Employee awareness programmes also require an overhaul. Traditional training that teaches staff to spot poor spelling or suspicious attachments is no longer sufficient. Employees must learn to question unexpected payment requests, verify changes to supplier banking details through independent channels and recognise AI-generated impersonation attempts.
Equally important is strengthening resilience through regular incident response exercises. As BEC attacks become more sophisticated, organisations need clearly defined processes for verifying financial transactions, escalating suspected fraud and responding quickly when accounts are compromised.
Finally, email security should no longer be viewed as a standalone technology stack. It must be integrated with broader Zero Trust architectures, identity protection platforms and cloud security strategies.
THE FUTURE OF EMAIL ATTACKS
If today's phishing campaigns are powered by generative AI, tomorrow's attacks are likely to involve autonomous AI agents.
Security researchers increasingly envision AI systems capable of conducting extended social engineering campaigns across multiple communication channels. An attack may begin with a personalised email, continue through Microsoft Teams or WhatsApp, reinforce credibility with an AI-generated voice call and eventually persuade an employee to disclose confidential information or approve a fraudulent payment.
In such scenarios, email is no longer the attack. It is simply the opening move.
The convergence of AI, identity theft and cloud computing is reshaping enterprise cybersecurity in ways that extend far beyond the inbox. Every digital interaction—an email, a login, a document share or a chat message— could become part of a coordinated attack chain.
For security leaders, this demands a shift in mindset.
Success will no longer be measured by how much spam is blocked or how many malicious attachments are quarantined. Instead, it will depend on how effectively organisations can verify identity, detect abnormal behaviour and respond to attacks before trust is exploited.
