91% of Cyberattacks Start With a Single Spam Email

That number comes from research that's been validated year after year. Verizon's 2022 Data Breach Investigations Report found that 82% of breaches involved a human element — and the overwhelming majority of those started in someone's inbox. A spam email isn't just an annoyance anymore. It's the front door threat actors use to walk into your organization.

I've been in cybersecurity long enough to watch spam email evolve from Nigerian prince scams to sophisticated, targeted operations that fool experienced professionals. If you think your spam filter handles the problem, you're already behind. This post breaks down what spam email actually looks like in 2022, why it still works, and what your organization needs to do about it right now.

Spam Email in 2022: Not Your Father's Junk Mail

Let's kill the outdated mental model. When most people hear "spam email," they picture poorly written messages hawking pharmaceuticals. That version still exists — but it's the decoy. The dangerous spam email in 2022 looks like a DocuSign notification from your CFO, a shipping update from FedEx, or a password reset request from Microsoft 365.

The Conti ransomware gang, before their internal leaks earlier this year, ran email campaigns that were nearly indistinguishable from legitimate business correspondence. They used thread hijacking — replying to actual stolen email threads — to bypass both human judgment and technical filters. The IcedID and Emotet malware families followed the same playbook throughout 2021 and into 2022.

This is social engineering at scale. Threat actors don't need to trick everyone. They need one person in your accounting department to open one attachment on one bad morning.

The Three Flavors That Actually Cause Damage

Not all spam email carries the same payload. Here's how I categorize the ones that matter:

  • Credential theft campaigns: These impersonate services your employees already use — Microsoft 365, Google Workspace, Dropbox, Slack. They link to pixel-perfect login pages. Once credentials are harvested, the attacker has legitimate access. No malware needed.
  • Malware delivery: Attachments disguised as invoices, purchase orders, or legal documents. They typically carry macro-enabled Office files, password-protected ZIP archives, or ISO disk images — all designed to evade automated scanning.
  • Business Email Compromise (BEC): No links, no attachments, no malware. Just a carefully written email that appears to come from a CEO or vendor, requesting a wire transfer or sensitive data. The FBI's IC3 reported that BEC losses exceeded $2.4 billion in 2021 — more than any other cybercrime category.

Why Spam Filters Aren't Enough — And Never Will Be

I hear this constantly from small and mid-sized business owners: "We use Office 365 / Google Workspace — spam gets filtered automatically." Here's what actually happens.

Modern email security platforms are good. They catch the vast majority of bulk spam. But threat actors specifically test their campaigns against these platforms before launching them. Services on the dark web let attackers validate that their payloads bypass Microsoft Defender, Proofpoint, Mimecast, and others before a single message gets sent.

In my experience, even well-configured enterprise email security catches about 95-98% of malicious email. That sounds great until you do the math. If your organization receives 10,000 emails per day, 200-500 malicious messages per day are getting through. Every single day.

The Gap Between Technology and Human Behavior

Technology handles volume. Humans handle judgment. The spam email messages that slip through filters are specifically designed to exploit human psychology — urgency, authority, fear, curiosity. A spam filter can't detect that your employee is having a stressful day and is more likely to click without thinking.

This is exactly why security awareness training exists. Not as a checkbox exercise, but as a genuine layer of defense. Organizations that combine technical controls with ongoing cybersecurity awareness training reduce their click rates on phishing simulations by 50-75% within the first year.

What Does a Dangerous Spam Email Look Like?

This section is for anyone who just searched "what is spam email" or "how to identify spam email." Here's the direct answer.

A spam email is any unsolicited message sent in bulk, but in cybersecurity, the term specifically refers to malicious emails designed to steal credentials, deliver malware, or manipulate recipients into taking harmful actions. Dangerous spam email typically includes one or more of these characteristics:

  • Sender address that's close but not quite right (e.g., [email protected])
  • Urgent language: "Your account will be suspended," "Immediate action required"
  • Links that go to domains unrelated to the supposed sender
  • Unexpected attachments, especially .zip, .iso, .docm, or .xlsm files
  • Requests for credentials, payment, or sensitive data
  • Display name spoofing — the "from" name looks right, but the actual email address doesn't match

The tricky part? Sophisticated threat actors now use legitimate services to host their phishing pages — Google Forms, Azure blob storage, Cloudflare Workers. The URL might look perfectly safe to both the filter and the recipient.

Real Incidents: What Spam Email Costs Organizations

Let me give you some concrete examples from 2021 and 2022.

Twilio — August 2022

Twilio disclosed a breach in August 2022 that started with SMS phishing, but the same technique works over email. Employees received messages that appeared to come from Twilio's IT department, directing them to a fake login page. Attackers harvested credentials and used them to access internal systems and customer data. The attack cascaded — affecting over 130 organizations that used Twilio's services.

The Emotet Resurgence — January 2022

After a coordinated law enforcement takedown in early 2021, Emotet came roaring back in late 2021 and scaled up operations in early 2022. Its primary delivery mechanism? Spam email with macro-enabled Excel attachments and password-protected ZIP files. Emotet doesn't just infect one machine — it serves as a loader for Cobalt Strike, ransomware, and data exfiltration tools. One spam email, opened by one employee, can lead to a full ransomware incident.

The Cost: $4.35 Million Average

IBM's 2022 Cost of a Data Breach Report pegged the average cost of a data breach at $4.35 million globally. Phishing — which starts as spam email — was the second most common initial attack vector and the most expensive, averaging $4.91 million per incident. These aren't theoretical numbers. They include forensics, legal fees, regulatory fines, lost business, and reputational damage.

Building a Spam Email Defense That Actually Works

I've helped organizations of every size build email security programs. Here's what works in practice — not theory.

1. Layer Your Technical Controls

Don't rely on one filter. Use your email platform's built-in protection plus a supplementary gateway or API-based solution. Enable SPF, DKIM, and DMARC for your own domain — this prevents attackers from spoofing your domain to target your partners and customers. CISA's Binding Operational Directive 18-01 made DMARC mandatory for federal agencies, but every organization should implement it.

2. Deploy Multi-Factor Authentication Everywhere

When credential theft from spam email succeeds — and it will eventually — multi-factor authentication is the safety net. It won't prevent the phishing attempt, but it can prevent the attacker from using stolen credentials. Prioritize MFA on email, VPN, remote desktop, and any cloud services. This is a core principle of zero trust architecture: never trust a credential alone.

3. Run Phishing Simulations Regularly

You need to test your employees with realistic phishing simulations — not once a year, but monthly. Track who clicks, who reports, and who ignores. The data tells you where your risk is concentrated. Our phishing awareness training for organizations gives you the tools and frameworks to run these campaigns effectively and turn results into targeted education.

4. Create a Reporting Culture, Not a Blame Culture

If employees are afraid to report that they clicked a suspicious link, you'll never detect compromises early. Build a one-click reporting button into your email client. Celebrate reports — even false positives. In my experience, organizations that reward reporting see 3-5x more suspicious emails flagged, which gives your security team critical early warning.

5. Train Continuously, Not Annually

Annual security training is compliance theater. Threat actors evolve their spam email tactics monthly. Your training should match that pace. Short, frequent modules — five minutes every two weeks — outperform hour-long annual presentations every time. Combine this with real-world examples from your own phishing simulations.

The Zero Trust Connection

Spam email defense fits directly into a zero trust security model. Zero trust assumes breach — it assumes that at some point, someone will click the wrong link or open the wrong attachment. The goal is to limit what happens next.

That means network segmentation, least-privilege access, continuous authentication, and endpoint detection. If a spam email delivers malware to one workstation, zero trust architecture ensures that workstation can't reach your domain controller, your file server, or your customer database without additional verification.

Spam email is the initial access vector. Zero trust is what keeps initial access from becoming a catastrophic data breach.

Your Next Move

Every organization I've worked with that took spam email seriously — truly seriously — reduced their incident rate dramatically. The ones that dismissed it as a solved problem kept showing up in breach headlines.

Start with an honest assessment. When's the last time you ran a phishing simulation? Do your employees know what to do when they receive a suspicious email? Is multi-factor authentication enforced across all critical systems?

If you're not sure where to begin, start with foundational cybersecurity awareness training for your entire team. Pair it with targeted phishing awareness training that includes simulations and measurable outcomes.

Spam email isn't going away. The only question is whether your organization is ready for the next one that lands in someone's inbox.