Security teams have always known phishing extends beyond email. The detection technology they invested in didn’t. That gap is now the fastest-growing exposure most organizations have.
Phishing has always been a multi-channel problem, and security teams have always known it. Awareness training programs have covered vishing, SMS lures, and physical social engineering for years. The threat was never confined to email.
What was confined to email was the technology. The $5 billion-plus email security market, the anti-phishing infrastructure built around secure gateways, DMARC authentication, inbox filtering, and AI-powered analysis, was designed for one channel. And for years, that made sense. It carried the dominant share of volume, and the phishing prevention tools that defended it matured into a genuine defense. Proofpoint’s 2026 State of the Phish data shows financial services reporting simulated phishing at 32 percent, the highest of any sector. The inbox stack works.
The question is how much of the problem it now covers. Hoxhunt’s 2026 Phishing Trends Report found that 40 percent of phishing campaigns now extend beyond it, reaching targets through Slack, Teams, social media, and messaging platforms. Push Security, which tracks browser-based threats, put it more starkly: roughly one in two phishing attacks is now delivered outside the inbox entirely. The ratio shifted. The tools did not shift with it.
The channels the inbox does not see
The clearest example of that gap arrived through search engines. ClickFix, a social engineering technique that delivers malware through fake browser update pages and CAPTCHA prompts, became the dominant initial access vector in Microsoft’s Digital Defense Report, accounting for 47 percent of observed attacks. Push Security’s Q2 2026 data put it at 52 percent of detections. Four in five ClickFix payloads were accessed through search engines via compromised sites, malvertising, and SEO poisoning. None of them arrived by email. None of them were visible to a secure email gateway.
Paid advertising has become another primary channel. Search ad fraud and malvertising place phishing pages directly in front of users searching for legitimate brands, backed by the credibility of a sponsored search result. Social media carries a parallel risk through fake customer support profiles, brand impersonation pages, and sponsored posts that redirect to credential harvesting infrastructure. And SMS phishing has grown fast enough that the APWG now tracks it as a distinct category, with smishing volume growing 40 percent and vishing up 20 percent in a single quarter of 2026.
CrowdStrike’s 2026 Global Threat Report documented a 134 percent year-over-year rise in vishing, with helpdesk impersonation via voice calls now the dominant social engineering pivot for ransomware affiliates. What is worth noting about all of these channels is that none of them are new. What changed is the economics. AI-generated voice cloning made vishing scalable. Phishing-as-a-service platforms made multi-channel campaigns accessible to operators who could not have built them independently. The channels that training programs warned about for years became operationally viable at volume, and the detection infrastructure that would have caught them was never built because the email stack seemed sufficient.
What changes when phishing protection moves to the infrastructure
An anti-phishing solution that ends at the inbox protects the employee’s email. It leaves uncovered the customer who reaches a phishing page through a Google ad, the job applicant who clicks a link in a fake LinkedIn message, and the brand whose identity is being borrowed to make all of it convincing. The common assumption is that the inbox is where phishing starts. In practice, the inbox is often the last channel the attacker bothers with.
The more interesting question is what happens when detection moves to where the infrastructure is built rather than where it arrives. Consider what becomes possible when a brand embeds beacon technology into its own web pages: if an attacker clones that page to build a phishing site, the beacon fires when they test it, alerting the brand’s security team before the campaign has reached a single target. That is a fundamentally different detection model from waiting for a malicious email to arrive and hoping the gateway catches it. Our detection data shows beacons improve time-to-detect and coverage by up to 50 percent, because the detection happens at the moment of infrastructure creation rather than the moment of delivery.
The same shift applies across every surface where phishing campaigns operate. Newly registered lookalike domains reveal phishing infrastructure as it is being assembled. Paid advertising scans catch campaigns at the point of promotion, before they reach a single click. Social media monitoring surfaces the fake profiles that lend credibility to the rest of the operation. Even phone numbers appearing on phishing pages, a detail most security tools overlook entirely, become takedown targets when the detection scope extends beyond URLs and domains.
Push Security’s data showed that 89 percent of phishing domains are active for fewer than two days. That window does not accommodate a workflow built around victims recognizing the threat and reporting it. It requires detection that operates at the infrastructure level, continuously, across every channel the campaign touches.
Inbox filtering, DMARC, and simulation training remain essential. They cover the channel they were built for, and they cover it well. This is the adjacent layer of phishing protection: the one that addresses phishing at its source rather than at its destination.
The Bottom Line
The anti-phishing industry spent two decades building automated detection for one channel, and the tools it built for that channel are genuinely good. What it did not build was the equivalent infrastructure for every other channel that phishing has always been capable of using, and that gap is no longer theoretical. Forty percent of campaigns now extend beyond email. Half of all attacks reach their targets through channels that never touch a mail server. ClickFix, the most common initial access technique of 2026, is delivered entirely through search engines. Training taught people to watch for these threats. The organizations closing the gap are the ones that stopped relying on training alone and started building detection for the channels where the volume has moved.
Key Takeaways
An anti-phishing solution is any tool, service, or protocol designed to prevent, detect, or respond to phishing attacks. Traditional anti-phishing software and tools focus on email security: secure email gateways, DMARC authentication, inbox filtering, and simulation training. Infrastructure-level solutions extend phishing protection to domains, paid advertising, social media, and messaging channels where phishing has always operated but where the anti-phishing industry historically has not.
Phishing has always been multi-channel, but the ratio has shifted. Hoxhunt’s 2026 report found 40 percent of campaigns now extend beyond email. Push Security’s data shows roughly one in two attacks delivered outside email entirely. ClickFix, the dominant initial access technique, reaches targets through search engines without touching an inbox.
Search engine malvertising, paid social ads, fake customer support profiles on social media, SMS phishing (smishing), voice phishing (vishing), and phishing pages on lookalike domains promoted through non-email channels. The APWG tracked smishing up 40 percent and vishing up 20 percent in Q2 2026 alone.
Detection that finds phishing campaigns at the source rather than the destination. It monitors newly registered domains for brand impersonation, scans advertising platforms for malicious sponsored results, and watches social media for fake profiles, connecting those detections into the coordinated campaigns they belong to rather than responding to threats one at a time.
By extending phishing prevention beyond the inbox to the infrastructure level: monitoring newly registered domains for brand impersonation, scanning ad platforms for malicious sponsored results, detecting fake social profiles, and pursuing takedowns of phone numbers and URLs across every channel. The channels growing fastest, search, social, SMS, and voice, are the ones where most organizations have no detection at all.
