The Email Threats Microsoft 365 and Google Workspace Won’t Catch (and How UAE Businesses Can Close the Gap)

Microsoft 365 and Google Workspace block most spam and known malware. They struggle with newer attacks, like token theft, QR code phishing, OAuth abuse, and payment fraud with no bad link at all. Some of these attacks get past MFA too. UAE businesses can close the gap with stronger sign-in rules, payment checks, staff training, and a dedicated email security layer that watches mailboxes, not just incoming mail.

Introduction

Most people assume their email platform has them covered. That is a fair guess, because the built-in filters are good. But the email threats Microsoft 365 and Google Workspace won’t catch are the ones attackers design on purpose.

Criminals test their messages against the same filters you use. They keep what works and throw away what doesn’t. By the time a new trick is widely known, it has already reached thousands of inboxes.

This guide explains five attack types that slip past native protection. It also shows where each platform has its own blind spots. You will finish with a simple checklist your team can act on this month.

If you want a primer first, read our guide on the difference between phishing, spear-phishing, and whaling.

Why Do Phishing Emails Still Get Past Microsoft 365 and Google Workspace?

Phishing emails get through because attackers test their messages against the same filters you use. They use fresh domains, clean links, and convincing text. Native filters work best on known threats, so new or targeted attacks can land in the inbox before anyone flags them.

Microsoft and Google block huge volumes of bad email every day. That is not the problem. The problem is the small share that gets through, because that share is now better written and better targeted.

Ready-made phishing kits are cheap to rent. AI tools write clean, personal messages with no spelling mistakes. The old advice to “look for typos” no longer works.

The money trail shows the impact. The FBI’s 2025 crime report recorded about $3.05 billion in business email compromise losses. That made it the second-costliest crime type. The same report noted over $30 million in losses tied to AI-enabled BEC.

What Is Adversary-in-the-Middle Phishing, and Why Doesn’t MFA Stop It?

Adversary-in-the-middle (AiTM) phishing places a fake login page between your user and Microsoft or Google. The user types a password and completes MFA as normal. The attacker copies the session token and signs in as them. Standard MFA codes and app prompts do not stop this.

The login looks real because the attacker’s page relays everything to the real service in real time. Your employee sees the right logo, the right prompts, and even the right MFA request.

Once the attacker holds the token, they do not need the password again. They can read mail, set up hidden forwarding rules, and send messages to your clients.

Phishing-resistant sign-in methods, such as passkeys and hardware keys, handle this attack much better. So do conditional access rules that flag odd locations and new devices. Email filters alone will not catch it, because the dangerous part happens after the click.

How Does QR Code Phishing (Quishing) Avoid Email Filters?

Quishing hides the malicious link inside a QR code image. Many filters read text links, not pictures, so the email looks clean. The user scans the code with a personal phone, which often has no company protection, and lands on a fake login page.

In one documented case, a QR code hidden inside an email attachment reached an accounts payable employee. It got past Microsoft Defender for Office 365. The scan led to an AiTM page, and the attacker stole the MFA session token.

The trick works because it moves the attack off your network. The scan happens on a phone outside your firewall and outside your endpoint tools.

A simple rule helps a lot: no one signs in to a work account by scanning a QR code from an email. Add it to your staff training and repeat it often.

What Are OAuth Consent and Device Code Attacks?

OAuth consent and device code attacks trick users into approving access instead of handing over a password. The user sees a real Microsoft or Google screen. One click gives the attacker a token that can read mail and files, and the password never comes into play.

In a consent attack, a fake app asks for permission to read your mail or files. In a device code attack, the victim enters a short code on a real login page. That code links the attacker’s session to the victim’s account.

Microsoft has described AI-assisted device code campaigns that create fresh codes on demand. That makes them harder to block with static rules. Phishing kits sold today now bundle AiTM, device code, and consent tricks in one panel.

Both platforms have tightened their defaults, which helps. Still, your admin should restrict which apps users can approve. They should also block device code sign-in where you do not need it, and review app permissions every quarter.

Business Email Compromise Without Malware: Fake Invoices and Hijacked Vendor Accounts

The most expensive attacks often have no link and no attachment. A message says, “Our bank details have changed, please pay the new account.” There is nothing to scan, so there is nothing for a filter to block.

Attackers use three common paths:

• A lookalike domain that swaps one letter, such as “rn” for “m”.
• A spoofed sender name that shows your CEO’s name on a personal address.
• A real, hijacked account from a supplier or colleague.

The third path is the hardest. A hijacked vendor mailbox passes SPF, DKIM, and DMARC, because the email really did come from that vendor’s system. Authentication proves where a message came from. It does not prove the sender is honest. If you want the basics, see our guide to how SPF, DKIM, and DMARC work together.

The same risk exists inside your own company. A compromised employee account can send “lateral” phishing to coworkers. Tools that only scan inbound mail from outside will miss it.

The best defense here is a process, not software. Any change to bank details gets confirmed by a phone call to a known number.

Which Gaps Are Specific to Google Workspace vs Microsoft 365?

Both platforms share the core blind spots above, but they fail in different places. Microsoft has a bigger target on its back, so most attack kits are built for it first. Google has its own quirks, especially around OAuth apps and older encryption.

Area	Microsoft 365	Google Workspace
Device code attacks	Higher risk, widely targeted	Lower risk, since Google limits what this flow can reach
OAuth consent abuse	Possible, needs admin limits	Possible, needs admin limits
Failed encryption	Can send the email in plain text, with no warning to the sender	Can fall back to old TLS 1.0 or 1.1, with no warning
DMARC	Needs setup and reporting	Needs setup and reporting
Hijacked internal accounts	Inbound-only scanning can miss it	Inbound-only scanning can miss it

The encryption point matters for any business that sends contracts, patient data, or financial records by email. A message can leave your company unprotected, and nobody sees an error.

For a deeper look at Microsoft’s own tools, read our comparison of Safe Attachments, Advanced Threat Protection, and DMARC.

What Should a UAE Business Do About These Email Threats?

Start by tightening sign-in rules, limiting app approvals, and setting a phone-call rule for payment changes. Then add a dedicated email security layer that checks mailbox behavior, impersonation, and images. Finish with staff training and round-the-clock monitoring so someone acts when an alert fires.

Here is a practical order of work:

1. Upgrade MFA. Move admins and finance staff to passkeys or hardware keys first.
2. Limit app approvals. Let only admins approve new third-party apps, and block device code sign-in if unused.
3. Set a payment rule. Confirm every bank detail change by phone.
4. Train for modern tricks. Cover QR codes, fake login pages, and urgent requests from “the boss”.
5. Add a layer on top. Use a service that watches mailboxes for impersonation and odd behavior.

UAE rules add pressure. The country’s shift toward mandatory cyber resilience, including NESA and PDPL requirements, means email controls now matter for compliance. Our UAE cyber resilience compliance guide explains what this means in practice.

This is where a managed service helps. Our advanced email security solutions in Dubai add anti-phishing, impersonation protection, malware scanning, and email encryption on top of Microsoft 365 or Google Workspace. We also set up SPF, DKIM, and DMARC, and train your staff. For full coverage, our Cybersecurity as a Service plan adds 24/7 SOC monitoring.

Conclusion

Microsoft 365 and Google Workspace are solid starting points, but they were never meant to be your only defense. The attacks that cause real losses are built to look normal. They use real login pages, real vendor accounts, and requests that feel routine.

The fix is layers: stronger sign-in, clear payment rules, trained staff, and a dedicated email security service. None of these is hard on its own. Together, they close the gaps attackers rely on.

Not sure where your business stands? Book a free email security assessment through our cybersecurity plans for small businesses page. You can also call or WhatsApp us on +971 52 607 3989.

FAQ