Opening the Email Was the Breach 

Kasey Cromer, Netlok | October 20, 2026 

Executive Summary 

Enterprise security strategy has long centered on the login screen. Prevent unauthorized access at authentication, the thinking goes, and the organization is protected. That model is incomplete. 

While preventing unauthorized access at authentication remains a critical control, the threat landscape has shifted in two directions that most security frameworks have not yet absorbed. First, some attacks do not require a user to click a malicious link or enter credentials. Vulnerable software can be exploited simply by processing a message. Second, when an attacker does obtain authenticated access, whether through exploitation, session theft, or social engineering, a password reset may not end the intrusion. The attacker’s access mechanism may already exist independently of the password or other authentication methods.  

Microsoft’s Microsoft Digital Defense Report 2026 found that password-based attacks declined 26 percent year over year, while adversary-in-the-middle phishing and token theft more than doubled in the first half of 2026. Verizon’s 2026 Data Breach Investigations Report found that exploiting vulnerabilities accounted for 31 percent of breaches, overtaking stolen credentials as the leading entry point. [1] [2] 

For CISOs, the executive question is not only whether the login was secure. It is whether the organization can identify and terminate unauthorized access after a login has occurred. 

You Don’t Have to Click 

Traditional security awareness training teaches employees to recognize suspicious links, verify sender addresses, and avoid entering credentials on unfamiliar pages. That training remains valuable. It is no longer sufficient as a complete strategy. 

A zero-click attack exploits a system without requiring the victim to deliberately activate anything. In an email context, vulnerable software may process malicious content while displaying or previewing a message. The attack does not depend on a persuasive pretext or a user who fails to recognize danger. It depends on unpatched software. 

A documented Windows vulnerability called CVE-2025-21298 affected a technology used to handle embedded content in documents and messages. Its vulnerability record shows no user interaction is required to trigger it, and remote code execution, meaning an attacker could cause a vulnerable system to run attacker-controlled instructions, was documented. Email previewing could provide the trigger. [3] 

A second documented example is CVE-2025-32711, known as EchoLeak. The Microsoft vulnerability record describes a flaw in Microsoft 365 Copilot that causes the system to follow attacker-controlled instructions as if they were legitimate, resulting in information being disclosed over a network. This is an information-disclosure vulnerability, not evidence that opening any email automatically compromises a session. The distinction matters: different vulnerabilities cross different security boundaries, and executives need specifics, not a one-size-fits-all label. [4] 

These vulnerabilities share a common implication. The perimeter of email risk now includes the software that processes messages, not only the decisions users make about the messages they receive. 

What Happens When You Open It 

Displaying email requires software to interpret content. The software that displays the message turns its underlying format into the text, images, and layout a person sees. A preview pane performs some of that work without opening a message in a separate window. Either can be the site of exploitation when the underlying software contains a vulnerability. 

An image pixel or tracking beacon is a tiny external image used to record that content was retrieved. Loading one is not proof of credential theft, session theft, or device compromise. Ordinary content retrieval and exploitation are different things, and conflating them produces threat assessments that mislead rather than inform. 

CVE-2025-21298 demonstrates the software-vulnerability category. EchoLeak CVE-2025-32711 demonstrates a different boundary: an AI-assisted system that follows malicious instructions embedded in material it processes.  

Email filtering remains valuable. Inspecting messages is not the same as removing vulnerabilities from the software that processes them. Microsoft’s 2026 report recommends correlating email, device, identity, application, and network signals together because attacks may remain invisible when those signals are assessed separately. [1] 

Why a Password Reset Is Not Enough 

When a compromised account is discovered, a password reset is typically the first response. For many attack paths, it is not sufficient. 

A password proves identity during a login. A session token is proof that authentication has already occurred. A session cookie is one way a browser carries that proof, allowing someone to continue using an application without entering credentials on every page. An OAuth grant goes further. It is a standing permission that allows one application to act on a user’s behalf inside another service, and it persists even after sessions end. 

A password and an OAuth grant are different objects with different lifecycles. A password change does not automatically expire active session tokens, revoke those permissions, or remove mailbox forwarding rules an attacker may have configured. Each requires its own remediation step. 

Microsoft’s Microsoft Digital Defense Report 2026 found that token theft more than doubled in the first half of 2026 as attackers shifted from password compromise to maintaining access after the initial login. Rather than stealing credentials, attackers capture session tokens that remain valid even after a password is reset. The report identifies two central risks: persistent attacker access, meaning the ability to re-enter systems even after a compromise is discovered, and weak identity governance, meaning organizations that cannot fully account for who holds access to what or have granted more permissions than roles require. It recommends governing both human identities and the application accounts and automated systems connected to enterprise identities. [1] 

Verizon’s 2026 Data Breach Investigations Report reinforces the point from a different direction: people were the entry point in 62 percent of breaches, targeted through social engineering, phishing, or credential theft, including scenarios where session tokens, not passwords, were the ultimate target. [2] 

The governing principle for recovery is straightforward. Remediation must remove the attacker’s access mechanism. A credential change is an action, not evidence that the environment is clean. An organization should establish which sessions have been terminated, which permissions have been revoked, and which attacker-created changes, including forwarding rules, registered devices, and connected applications, have been reversed. 

The Scale of Email-Based Identity Compromise 

The BigBear 2.0 phishing platform, documented by CloudSEK researchers in 2026, illustrates how session theft operates at scale in active campaigns. The platform functioned as a fraudulent relay, proxying victims through a counterfeit sign-in page to the legitimate Microsoft login service. Victims completed authentication, including multi-factor authentication, while the platform captured the resulting session tokens. Those tokens were then replayed to access mailboxes, Teams environments, SharePoint, and connected applications without triggering re-authentication. CloudSEK documented that 80 percent of password entries resulted in session token capture. [5] 

This attack type does not require the victim to recognize a suspicious page. The Microsoft login experience the victim sees is real. The relay is invisible. Multi-factor authentication is completed successfully. The attacker’s access begins after authentication concludes. 

Microsoft’s Microsoft Digital Defense Report 2026 tracks a related pattern: social engineering campaigns that impersonate passkey prompts, using urgency and false authority to guide victims through a device authorization flow. The victim completes what appears to be a legitimate authentication step. The attacker receives the resulting device authorization or session token, gaining persistent access to the account. [1] 

Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation accounted for 31 percent of breaches analyzed, overtaking stolen credentials as the way attackers first entered. The dataset spans incidents from November 2024 through October 2025.  [2] 

How Email Access Becomes Enterprise Access 

An enterprise mailbox contains more than correspondence. It may, for example, expose internal discussions, shared documents, supplier relationships, financial workflows, and account recovery messages. Its value to an attacker depends on both the information it holds and the services connected to the identity behind it. 

Consider a straightforward scenario. An attacker gains access to a finance executive’s mailbox, reviews an ongoing supplier payment discussion, and sends an instruction from the legitimate account. The attacker does not need to invent the relationship or study the writing style from scratch. The context is already there. 

A more consequential path targets the systems that control who can access enterprise resources. An email account tied to an administrator identity may carry access to cloud consoles, approval workflows, connected applications, and the ability to register new devices or create new access paths. The relevant boundary is not the mailbox. It is the permissions and integrations available to that identity. 

Microsoft’s 2026 report warns that persistent access, unnecessary privileges, and fragmented visibility create compounding opportunities for attackers. It recommends governing human and non-human identities, including applications and AI agents, while correlating signals across systems to detect access that no longer resembles the legitimate user. [1] 

For CISOs, an email incident should trigger a review of the account’s connected access, not only the messages it received. A compromised mailbox can be the first visible symptom of a broader identity problem. 

Photolok by Netlok: Protecting the Identity Layer 

Photolok by Netlok operates at the identity layer and integrates with platforms such as Okta Workforce. It addresses the human login that precedes email access and every enterprise session that follows it. 

Photo-based authentication. Photolok replaces password-based credentials with photo-based authentication designed to strengthen identity assurance at login. Each photo carries an encrypted code that changes with every login, is tied to the user’s registered device, and requires a server-side access code to validate. Even if an attacker obtains the photos, the encryption and device binding make them unusable. This approach is inherently resistant to phishing and authentication replay, stopping an attacker from reusing a captured login exchange. 

1 Time Photo. Users can configure up to five single-use photos for authentication. When at least one 1 Time Photo is set up, it always appears on the first login panel by itself, with no other login photo in the panel. The exception is a Duress scenario: if a Duress Photo has been configured, the photo panel will present two photos capable of completing login, not just one. If the user selects the Duress Photo to complete login, the 1 Time Photo is not used. It carries over and will appear again at the next login. Once used, that photo is no longer available, and the encrypted codes tied to it have already expired, making it inherently resistant to replay attempts. For organizations concerned about session persistence after a compromised login, Photolok addresses the threat at the point of entry: the authentication itself. 

Duress Photo. Users can configure up to two Duress Photos. Duress Photos are silent alarms, randomly selected for display during login, and can signal that a user is under coercion. If an employee is pressured into initiating a session, whether by a social engineer on a phone call or a threat actor present in the environment, selecting a Duress Photo triggers a real-time alert to security teams the moment it is chosen. The security operations center receives a real-time distress signal while the login appears normal to anyone watching. 

Photolok does not patch software vulnerabilities in email applications, inspect email content, or prevent device-level exploitation. The human login is a directly controllable security boundary. Strengthening it with photo-based credentials, single-use authentication, and real-time duress signaling addresses the identity layer where enterprise access begins. 

The Bottom Line 

The breach does not always begin with a bad decision. It can begin with vulnerable software processing a message, or with a session token captured after a user completed authentication successfully. 

That does not make security awareness training obsolete. It makes “do not click” insufficient as the entire strategy. 

The response must connect patched software, email protection, device defenses, and identity governance. Microsoft’s 2026 report makes the same case: correlated security signals, disciplined privileges, and resilience across interconnected systems are the architecture of modern enterprise defense. Verizon’s 2026 findings confirm that exploitation has overtaken credential theft as the leading breach entry point, reinforcing that vulnerability management and identity governance must advance together. [1] [2] 

Successful authentication is a checkpoint, not a permanent guarantee. The essential question for every security leader is whether the organization can identify and terminate unauthorized access after that checkpoint has been crossed. 

Request Your Personalized Demo 

Request a personalized Photolok demonstration from Netlok. 

About the Author 

Kasey Cromer is Director of Customer Experience at Netlok. 

Sources 

[1] Microsoft. Microsoft Digital Defense Report 2026. 2026. Report 

[2] Verizon. 2026 Data Breach Investigations Report. 2026. Dataset covers November 2024 through October 2025. Report 

[3] Microsoft Security Response Center. Windows OLE Remote Code Execution Vulnerability, CVE-2025-21298. 2025. Advisory 

[4] Microsoft Security Response Center. M365 Copilot Information Disclosure Vulnerability (EchoLeak), CVE-2025-32711. 2025. Advisory 

[5] KnowBe4 / CloudSEK. Warning: New Phishing Kit Targets Hundreds of Organizations. September 2026. Report 

[6] Netlok. How Photolok Works. netlok.com