When people picture a cyber attack arriving by email, they usually imagine something obvious.
An attachment with a virus.
A suspicious file.
Something antivirus immediately flags.
But many of the most successful email attacks today contain no malware at all.
No infected files.
No dangerous attachments.
Just a normal looking email – and that’s exactly why they work.
A different kind of email attack
A while ago I spoke with a business owner who was convinced their email security was solid.
They had spam filtering.
Attachment scanning.
The usual protections most organisations rely on.
Yet someone had still managed to send invoices to their customers from the company’s own email account.
No malware had been installed.
The attacker had simply gained access to the mailbox.
Once inside, they quietly watched conversations between the business and its customers. After a few days they replied to an existing email thread with updated payment details.
Everything looked legitimate.
The customer paid the invoice.
Just not to the right bank account.
Why these attacks are increasing
Cyber criminals have realised something important.
Malware is noisy.
It gets detected.
It triggers alerts.
It raises suspicion.
Compromised email accounts are much quieter.
If attackers can trick someone into entering their Microsoft 365 or Google Workspace credentials on a phishing page, they can simply sign in and behave like a normal user.
From there they can:
read emails and monitor conversations
impersonate staff or executives
send phishing emails internally
redirect invoices or payments
None of this requires malware.
Just access.
Why traditional email security can miss these attacks
Many organisations still rely on email security tools that were designed years ago.
They focus heavily on scanning attachments for malicious files.
That approach worked well when most attacks involved infected documents or executable files.
But modern email threats have evolved.
Today’s attacks often involve:
credential phishing pages
impersonation of colleagues or executives
business email compromise (BEC)
malicious links hidden inside legitimate looking messages
By the time an attacker is sending emails from a legitimate mailbox, traditional filters may see nothing unusual.
Email is no longer the only target
Another change in recent years is that attacks don’t stop at the inbox.
Once attackers gain access to a cloud account, they may try to use collaboration platforms as well.
Files and messages shared through tools like:
Microsoft Teams
SharePoint
OneDrive
Google Drive
can all become part of an attack chain.
That means protecting email alone is no longer enough.
How modern email security hHelps
Modern cloud email security platforms focus on analysing messages, links and communication patterns rather than just scanning attachments.
For example, solutions like Check Point Harmony Email & Collaboration are designed to detect threats such as:
phishing attempts
impersonation attacks
malicious links and attachments
business email compromise
suspicious activity indicating a compromised account
They also scan files and messages shared through collaboration platforms such as Teams, SharePoint and OneDrive to help prevent threats spreading inside an organisation.
Why businesses are paying more attention to email security
For many organisations email is still the front door to the business.
Invoices arrive there.
Suppliers communicate there.
Contracts and payments are discussed there.
If an attacker controls a mailbox, they effectively have a seat inside the organisation.
That’s why many businesses are now looking beyond basic spam filtering and investing in more advanced email and collaboration protection.
Not just to stop obvious threats.
But to detect the subtle ones that look completely normal.
Final thought
The most dangerous email isn’t the one carrying malware.
It’s the one that looks like it belongs there.
If you’d like to review how secure your Microsoft 365 or Google Workspace environment really is, we’re always happy to help.
Black Swan Cyber Security Solutions supports organisations across Derbyshire and South Yorkshire with modern email security, identity protection and 24/7 cyber threat monitoring.
