Why Email Security Should Target Phishing Infrastructure, Not Just Messages
Summary
A Doppel co-founder argues that email defenses should connect inbox signals to attacker infrastructure and help disrupt it, because phishing campaigns can span lookalike domains, fake profiles, SMS and voice channels.
Key points
- The author says attackers may prepare lookalike domains, SSL certificates, fake profiles and backup SMS or voice channels before sending phishing emails.
- The article argues generative AI can accelerate personalized lure creation and campaign changes, weakening reliance on fixed indicators and writing-style clues.
- Recommended defenses include checking domain and hosting signals alongside email content and coordinating takedowns of malicious infrastructure.
- Doppel describes its Email Security product as using agentic AI and a threat graph to connect email signals with domains, hosting patterns and impersonation activity; these are vendor claims.
- The article cites FBI figures stating business email compromise represented roughly 14.6% of reported cybercrime losses in 2025, exceeding $3 billion.
Article Details
- Topic
- External-infrastructure-focused defenses against AI-enabled, multichannel phishing and business email compromise
MITRE ATT&CK
T1566 · PhishingThe article describes phishing campaigns delivered by email, including links intended to prompt victims to disclose credentials or payment data.T1583.001 · DomainsThe article describes attackers registering lookalike domains and preparing sending infrastructure for phishing campaigns.T1585.001 · Social Media AccountsThe article describes attackers creating fake executive profiles on LinkedIn to support impersonation campaigns.