Discover Sublime
December 16, 2025
Phishing remains one of the most reliable and cost-effective attack vectors for adversaries because it exploits human trust, business workflows, and implicit communication patterns, not only technical weaknesses. As email infrastructures harden, attackers shift to vectors that mimic legitimate behavior, impersonating trusted vendors, embedding text inside images, hiding payloads in HTML files, or using QR codes and calendar invites to bypass traditional filters.
AI-generated text and automation have also increased the volume and believability of phishing attempts. What once looked like simple spam now resembles high-fidelity internal communication.
Modern phishing attacks rarely rely on obvious indicators. Attackers use behavioral mimicry, cloud infrastructure, and AI to blend into legitimate communication. Legacy categories like “bulk phishing” or “link-based attacks” no longer capture how threats operate. The list below reflects the phishing techniques that security teams encounter in real environments, including cross-channel attacks, MFA bypass methods, and image-based obfuscation.
This guide breaks down 17 modern phishing attack types that SOC analysts, detection engineers, and security leaders need to understand, and it explains how to detect them effectively using the Sublime Security Platform powered by explainable detection logic, behavioral modeling, and agentic AI.
Phishing succeeds because it blends technical evasion with human manipulation. Attackers know that even strong perimeter controls cannot prevent every malicious message from landing in an inbox. Once a message arrives, the user becomes the vulnerability.
Traditional email security struggles because most solutions are black box, one-size-fits-all, and slow to adapt. The Sublime Security Platform uses transparent detections, behavioral modeling, and autonomous AI agents to identify attacks based on signals that reflect how your organization actually communicates, not generic global patterns.
This list removes outdated categories and focuses on the phishing techniques that organizations face today.
Mass phishing campaigns designed to steal credentials or deliver malware. Often includes spoofed brands or deceptive login pages.
How to spot it: suspicious language, mismatched domains, payment-themed lures, unfamiliar senders.
Sublime detects it through:
Keywords added: basic phishing attacks, phishing techniques, brand impersonation phishing.
Targeted attacks against specific individuals or teams that reference internal context or personal details.
How to spot it: personalized details, tone shifts, requests inconsistent with historical behavior.
Sublime detects it through:
Added variants: targeted phishing attacks, tailored phishing lures.
Impersonation of executives, employees, or vendors to manipulate financial or data workflows. Often contains no links or attachments.
How to spot it: unexpected payment changes, domain lookalikes, new supplier instructions.
Sublime detects it through:
Variants added: payload-free phishing, social engineering fraud.
A subtype of BEC that targets senior leaders.
How to spot it: unusual approval requests, sudden high-pressure messages.
Sublime detects it through:
Variants added: executive phishing attacks.
Attackers copy a legitimate email and resend it with malicious links or attachments.
How to spot it: altered URLs, unexpected attachments in previously trusted threads.
Sublime detects it through:
Variants added: email cloning attacks, replicated phishing emails.
An attacker replies within an existing conversation after compromising an account.
How to spot it: new attachments or links in an old thread, abrupt tone changes.
Sublime detects it through:
Variants: reply-chain phishing, account takeover phishing.
Reverse proxy phishing that steals credentials and session tokens. Allows attackers to bypass MFA.
How to spot it: suspicious login prompts, unexpected device enrollment messages.
Sublime detects it through:
Variants: MFA bypass phishing, session hijacking attacks, reverse proxy phishing.
Fake login portals impersonating Microsoft 365, Google, Okta, payroll systems, or financial apps.
How to spot it: subtle visual discrepancies, unusual redirect flows.
Sublime detects it through:
Variants: credential theft phishing, login-page impersonation.
Instead of stealing passwords, attackers trick users into granting malicious apps access.
How to spot it: unfamiliar apps requesting broad permissions.
Sublime detects it through:
Variants: cloud app phishing, token-grant phishing attacks.
URLs or attachments that deliver loaders, stealers, or RATs.
How to spot it: unexpected attachments such as .html, .zip, or .img files, encoded scripts.
Sublime detects it through:
Variants: malware delivery phishing, phishing with malicious attachments.
Phishing emails used to initiate ransomware operations.
How to spot it: suspicious invoices, password-protected archives.
Sublime detects it through:
Variants: ransomware phishing, initial access phishing attacks.
JavaScript inside HTML files reconstructs malware on the client device.
How to spot it: unexpected HTML attachments, encoded script blocks.
Sublime detects it through:
Variants: HTML-based phishing, encoded payload phishing.
Email content or attached documents contain QR codes that redirect to credential harvesting sites.
How to spot it: invoices or IT notifications containing unexpected QR codes.
Sublime detects it through:
Variants: QR phishing, QR credential theft attacks.
Emails that instruct users to call a phone number that leads to live social engineering.
How to spot it: fake subscription renewals, invoice disputes, help desk alerts.
Sublime detects it through:
Variants: callback phishing, hybrid phishing phone scams.
Phishing delivered through SMS, often connected to broader account takeover attempts.
How to spot it: SMS messages with shortened URLs or requests for MFA codes.
Sublime detects it through:
Variants: SMS phishing attacks, mobile phishing threats.
Phishing delivered via Slack, Teams, LinkedIn, or X notifications that surface in email.
How to spot it: unusual invites or impersonated corporate accounts.
Sublime detects it through:
Variants: collaboration-platform phishing, social network phishing attacks.
Malicious .ics files inject phishing links directly into users’ calendars.
How to spot it: unexpected meetings with embedded links, especially from external senders.
Sublime detects it through:
Variants: calendar invite phishing, scheduling-based phishing attacks.
Attackers embed text inside images to evade NLP filters. Common in fake login screenshots, invoices, or security alerts.
How to spot it: image-heavy messages where text cannot be selected.
Sublime detects it through:
Variants: image-only phishing, OCR-evasive phishing, image-obfuscated phishing.
Modern phishing evolves too quickly for static rules or global black box AI. Sublime’s agentic architecture provides a fundamentally different approach.
Triages, investigates, and remediates user-reported phishing automatically.
Creates new detection coverage within hours and eliminates vendor bottlenecks.
Adapts protections to your environment and learns from your communication patterns.
Together, these capabilities reduce false positives, accelerate investigations, and catch the modern attacks that legacy vendors miss.
What are the most common types of phishing attacks?
Common phishing attack types include email phishing, spear phishing, business email compromise (BEC), credential phishing, thread hijacking, HTML smuggling, QR code phishing, and callback phishing. These represent the majority of real-world incidents handled by SOC and detection engineering teams.
Which phishing attacks are the hardest to detect?
The most difficult attacks to detect include BEC with no payloads, image-based phishing where text is hidden inside images, and ICS or calendar phishing. These require behavioral analysis, NLU, OCR, and organization-specific modeling.
What are the red flags of a phishing attack?
Reliable indicators include urgent or unusual tone, domain mismatches, unexpected attachments, HTML files, QR codes, image-contained text, sudden thread replies, and requests for payment changes or sensitive data.
How do attackers make phishing emails look legitimate?
Threat actors rely on AI-generated text, cloned login pages, lookalike domains, thread hijacking, image-based lures, and OAuth consent screens that appear authentic. Sublime detects these through computer vision, OCR, NLU, and behavioral baselines.
How does phishing bypass traditional email security tools?
Modern phishing bypasses legacy tools by avoiding typical IOCs, using HTML smuggling, embedding lures in images or QR codes, delivering attacks through calendar invites and collaboration apps, hijacking legitimate threads, and using reputable cloud infrastructure.
Sublime releases, detections, blogs, events, and more directly to your inbox.
.svg)
See how Sublime delivers autonomous protection by default, with control on demand.
.svg)
