If you’ve read Part 1 of this series, you’ve seen the broad argument: the two dominant email security architectures were each built around an assumption that no longer holds. This post is about what that looks like in practice — four specific techniques attackers use today, each one aimed squarely at a gap that exists regardless of which of those two architectures an organization has deployed.
Quick answer: Modern email attacks are engineered to look clean to the systems checking them. Attackers hide malicious links inside QR codes instead of text, wrap payloads in file formats that dodge Windows’ own security warnings, spoof executives from real webmail accounts that pass every cryptographic authentication check, and count on the fact that a phishing alert in one tool rarely reaches the identity or endpoint system that could catch the next stage of the same attack.
The exploit: Attackers have mostly moved on from raw hyperlinks and .exe attachments, because those are exactly what text-based and signature-based filters are tuned to catch. Instead, they lean on formats designed to be opaque to automated inspection. Quick-response codes — QR codes — embedded in an attached PDF invoice or a shipping notice put the malicious login link inside an image the recipient has to scan with their own phone, well outside the reach of a text-scanning filter. Separately, weaponized files get packaged inside .iso, .vhd, .one (OneNote), and .lnk containers specifically because Windows’ Mark-of-the-Web security warning — the “this file came from the internet, are you sure?” prompt — doesn’t always propagate correctly once a payload is nested inside one of these container formats.
Why filters miss it: Text-based analysis has nothing to inspect in a QR code; the malicious destination is only readable once a phone camera decodes it. And on the container side, most gateways parse files by extension and known-bad signatures, not by fully unpacking a nested container and evaluating what’s inside it. The gap isn’t hypothetical: Microsoft’s own threat intelligence recorded QR code phishing surging 146% over the first quarter of 2026 — from 7.6 million attacks in January to 18.7 million in March — with PDF attachments as the dominant delivery method in roughly two-thirds to seventy percent of cases. Attackers are visibly moving toward this technique because it works.
The exploit: This one doesn’t require any cleverness at all — it exploits how security teams respond to their own tools. A legitimate password-protected .zip file, the kind a CPA firm sends with a client’s tax documents or a law firm sends with a sealed filing, looks structurally identical to a weaponized encrypted archive designed to hide malware from scanning. A blunt filter can’t tell them apart, so it quarantines or deletes both.
Why filters miss it: The failure here isn’t really about missing an attack — it’s about what happens next. When legitimate, time-sensitive business files get blocked often enough, the pressure from frustrated business units eventually pushes IT toward broad allowlisting: an exception for a sender domain, a file type, or a client relationship, applied more permissively than anyone would choose in isolation. Attackers are aware this happens across the industry and specifically craft lures that mimic the exact kind of “legitimate encrypted business file” pattern that tends to get allowlisted, banking on the accommodation rather than trying to sneak past a filter operating at full strictness.
The exploit: SPF, DKIM, and DMARC exist to verify that an email actually came from the domain it claims to be from — and they do that job well. The loophole attackers exploit isn’t a weakness in that cryptography; it’s an assumption downstream of it. An attacker registers a free Gmail, Outlook, or Yahoo account, sets the display name to your CEO’s actual name, and sends from it. Because the message genuinely originates from Google’s or Microsoft’s own mail servers, SPF passes, DKIM passes, and DMARC passes — all correctly, because the email really is authenticated as coming from gmail.com. It was just never from your CEO.
Why filters miss it: Many detection systems treat “passed authentication” as a strong trust signal and adjust risk scores downward accordingly, which is exactly backwards for this specific pattern. Credential- and identity-based deception like this is a large piece of why Verizon’s 2026 DBIR found credential abuse present somewhere in the attack chain of 39% of all breaches — the single most common factor in the dataset when you trace a breach through its full lifecycle rather than just its first step. A display-name spoof from a free webmail account is precisely the kind of authenticated-but-illegitimate message that a naive trust model rewards instead of flags.
The exploit: This blind spot doesn’t live inside any single email, it lives between systems. Say an email filter correctly flags a credential-harvesting link and blocks it. That’s a win — but it’s also frequently where the story ends, because the intelligence that a specific user was targeted, and may have already interacted with the sender before the block took effect, stays inside the email vendor’s own dashboard.
Why filters miss it: A phishing attempt is rarely the whole attack; it’s usually the opening move. Verizon’s 2026 DBIR found that 50% of ransomware victims had a credential theft or infostealer event in the 95 days before the ransomware itself deployed — meaning the email that got “caught” was often just the first data point in a chain the security team never got to see connected. When an email security tool operates as its own island, a SOC analyst has to manually go pull Active Directory logs, check for anomalous authentication, and review endpoint activity for the same user — work that takes time an attacker who already has a foothold doesn’t need to wait for.
None of these four techniques are exotic. Quishing is just phishing with the link moved somewhere your filter can’t read it. Encrypted-archive abuse just exploits the operational tradeoff every blunt filter is forced to make. Executive spoofing from free webmail just exploits a trust assumption baked into how authentication results get interpreted. And siloed alerting just exploits the fact that most tools were never built to talk to each other.
Each one is fixable — but only by an architecture that was designed with these specific gaps in mind from the start, rather than one that’s had detection rules bolted onto it after each new technique gets attention.
That’s the subject of Part 3, where we look at how Seceon aiEmail™ approaches these four gaps directly, as a native part of a broader security platform rather than a standalone inbox tool.
What is quishing (QR code phishing) and why is it hard to detect?
Quishing is phishing where the malicious link is embedded in a QR code — often inside a PDF attachment or an image in the email body — rather than as plain text. It’s hard for traditional filters to catch because the destination URL isn’t readable as text until a phone camera decodes the QR code; text- and link-scanning tools have nothing to inspect. Microsoft recorded a 146% surge in QR code phishing volume in Q1 2026 alone.
Why do SPF, DKIM, and DMARC pass on emails that are actually spoofed?
Because those protocols verify that a message genuinely originates from the domain it claims — they don’t verify that the sender is who they claim to be as a person. An attacker sending from a real Gmail or Outlook account with a spoofed display name (matching, say, a CEO’s real name) passes all three checks correctly, because the email really is authenticated as coming from Google’s or Microsoft’s servers.
Why does blocking encrypted or password-protected email attachments cause problems?
Because legitimate business files — tax documents from an accountant, sealed legal filings, confidential contracts — are frequently sent as password-protected archives, and a blunt filter often can’t distinguish those from a weaponized encrypted archive hiding malware. Over-blocking creates business disruption, which tends to push IT teams toward broader allowlisting that attackers can then exploit.
Why does it matter if an email security tool doesn’t integrate with the rest of a security stack?
Because a blocked phishing email is often just the first visible step of a longer attack chain. Verizon’s 2026 DBIR found that half of ransomware victims had a credential theft or infostealer event within 95 days before the ransomware deployed. An email tool that can’t correlate its findings with identity and endpoint activity leaves that connection for an analyst to find manually — if they find it at all.
This is Part 2 of a 3-part series on modern email security architecture. Read Part 1: Your Email Gateway Isn’t Broken. It Was Never Built for This, or continue to Part 3: Inside Seceon aiEmail’s Architecture.
