AegisAI Perspectives · 023
Zero-day email attacks evade traditional filters because signature, reputation, sandbox and link checks match what is known, and new attacks match none.
Zero-day email attacks evade traditional security filters because those filters match what is already known, and a new attack matches nothing. AegisAI's Q3 2026 State of the AI Attack report found phishing rose 49% this quarter1. Reputation and blocklist systems match each message against known-bad indicators22, and a never-seen attack carries none.
They pass each check by giving it nothing it has seen before. The eight stages below follow one message from the mail path into the mailbox, with the control each stage defeats.
Reputation and blocklist systems match a message against known-bad indicators, as the analysis of why zero-day phishing and AiTM attacks are invisible to traditional email filters sets out. Microsoft describes the built-in protection in every cloud mailbox as stopping broad, volume-based, known attacks7. A new payload has no hash on file and a domain registered this week has no history, so both pass.
Microsoft 365 spam filtering learns from known spam and phishing threats and from user and admin feedback13. A lure written fresh for one target shares little with that training data. 50.3% of AI-generated phishing got past the built-in Gmail and Microsoft filters, against 28.5% of human-written phishing20.
NIST recommends SPF and DKIM, plus DMARC, for authenticating a sending domain16, and Google Workspace asks admins to set them up against spoofing and forged mail15. These records check who sent a message. Of the AI-written spear phishing that got through, 72.6% passed DMARC21, and why DMARC-passing emails can still be phishing explains the trust hijack behind it.
Safe Attachments opens attachments in a virtual environment before delivery to look for harmful content, a process Microsoft calls detonation9. It cannot fully scan or detonate a password-protected attachment unless the password is available10. A file locked with a password the filter does not hold reaches the reader without a full detonation.
Safe Links scans and rewrites URLs in inbound mail during mail flow, then verifies them again at the time of click11. A link that is clean at delivery passes the first check. Microsoft's own scenario table lists a link that was legitimate on delivery and weaponized later, which goes undetected when Safe Links checks by API only in a client that does not support the API, so the user is phished12.
Some phishing kits decide who sees the lure. The Wazza kit treats a scanner differently from a person5. The automated visit a link check makes is therefore not the visit the target gets.
Some campaigns open with a message that carries neither. In the fake sponsorship deals tracked by Threat Watch, early messages carry no link or file, so the first emails give a filter and a recipient little to object to6. The sandbox and link checks above need a file or a link to work on.
Zero-hour auto purge can act on phishing and spam after they are delivered to Exchange Online mailboxes14. It acts on a later verdict, so the message stays in the mailbox until that verdict arrives.
AegisAI investigates every email for what it is trying to do, and removes the ones that fail from every mailbox they reached, as the page on how inbound email security works for Microsoft 365 and Google Workspace describes. It reads mail through the Microsoft 365 or Google Workspace API after delivery. One bad email is pulled from every inbox it reached, forwards included.
The numbers show phishing up 49% this quarter and built-in filters passing 50.3% of AI-generated phishing. The table puts the Q3 2026 report and blog figures next to two primary outside sources.
| Figure | What it measures | Source |
|---|---|---|
| 49% | Rise in phishing in Q3 2026 | Q3 2026 State of the AI Attack report |
| 0.2% to 7.7% | AI Dragnet attacks from hijacked accounts | Q3 2026 State of the AI Attack report2 |
| 11.6x, from 0.5% to 5.8% | AI Dragnet share of all confirmed phishing, growth this quarter | Q3 2026 State of the AI Attack report |
| 50.3% against 28.5% | AI-generated against human-written phishing that got past built-in Gmail and Microsoft filters | Email Security Threats in 2026 |
| 72.6% | AI-written spear phishing that got through and passed DMARC | Email Security Threats in 2026 |
| 31% | Breaches that now start with software vulnerabilities | 2026 Verizon DBIR18 |
| $16.6 billion | Complaint-reported losses in 2024, a 33 percent increase from 2023 | FBI Internet Crime Complaint Center17 |
The DBIR and IC3 rows add outside scale, with 31% of breaches starting with software vulnerabilities and $16.6 billion in complaint-reported losses in 2024.
A real kit beat link scanners by treating them differently from the people it targeted.
Real case, Threat Watch, 15 October 2026
Wazza: A Device Code Phishing Kit That Decides Who Sees the Lure describes a kit that runs every visitor through four checks before it shows an Adobe-themed device code page4. The kit treats a scanner differently from a person. A link check at delivery or at click is a scanner visit, so it does not get the page the target gets. The signal left for a defender is the request in the email, to visit a device code page.
A zero-day email attack is a message whose payload, sender, link or wording no filter has seen before, so no rule exists to match it. Microsoft describes Defender for Office 365 Plan 1 as protection against zero-day malware and phishing, plus business email compromise, above the built-in features8. In email the term covers more than a software exploit, since a new lure, a new domain or a hijacked account with no record of abuse is zero-day to a filter too.
Traditional filters fail because each check answers one question, "have I seen this before?", and a zero-day threat is built to answer no. Reputation and blocklists match known-bad indicators. Content filters learn from known threats. Authentication checks the sending domain.
None of those checks reads the purpose of the message. The gateway version of the same problem, with each inspection point, is set out in why a secure email gateway still misses phishing.
The common evasion techniques in 2026 are hijacked accounts, password-locked files, links that turn bad after delivery, scanner-aware kits and messages with no payload. In the Q3 2026 report, AI Dragnet attacks from hijacked accounts went from 0.2% to 7.7%. Mail from a real account passes authentication because the account is real.
Password-protected files block full detonation. Links weaponized after delivery slip past a delivery-time scan. Kits such as Wazza treat scanners differently from people, and fake sponsorship campaigns open with messages that carry no link or file.
Generative AI writes a new lure for each target, and new wording is what a zero-day attack needs to pass content filters. 50.3% of AI-generated phishing got past built-in Gmail and Microsoft filters, against 28.5% of human-written phishing. The AI Dragnet share of all confirmed phishing grew 11.6x this quarter, from 0.5% to 5.8%.
In the second stage, the message goes out from a hijacked account, so new wording arrives on a domain that authenticates. Of the AI-written spear phishing that got through, 72.6% passed DMARC.
Behavioral detection stops zero-day email attacks by reading what a message asks the recipient to do, which an attack cannot hide without failing its own goal. A lure still has to ask for something: a visit to a device code page, or a reply to a sponsorship offer. That request survives a new domain and a clean hash. It survives a DMARC pass too.
Zero-hour auto purge already acts on delivered mail in Exchange Online, so a check on intent can run after delivery as well. The test for any post-delivery check is whether it removes every copy before users see or click it.
Track three counts, each from a log you already have.
They give every check nothing known to match. A new hash passes signature scans, a hijacked account passes reputation and DMARC, a password-locked file skips full detonation, and a link that turns bad after delivery passes the delivery scan.
No. DMARC builds on SPF and DKIM, and all three authenticate the sending domain. They do not judge what the message asks for. Of the AI-written spear phishing that got through filters, 72.6% passed DMARC.
Only when the sandbox can open the file. Safe Attachments detonates attachments in a virtual environment before delivery, but it cannot fully scan a password-protected attachment without the password. Locking the file is enough to skip full detonation.
Partly. Safe Links checks URLs during mail flow and again at the time of click. Microsoft's own scenario table still shows a link that was legitimate on delivery and weaponized later going undetected in one configuration.
No. Some carry no payload at all: early messages in the fake sponsorship campaign carried no link or file. Software flaws still matter, and the 2026 Verizon DBIR finds 31% of breaches start with software vulnerabilities.
Pull every copy from every mailbox, then add a check on what the next message asks the reader to do. In Exchange Online, zero-hour auto purge acts on phishing after delivery. Measure the time between delivery and removal for each miss.
