WHY ‘CALL THIS NUMBER' TOAD EMAILS BEAT GATEWAYS

Summary from the TLDR InfoSec newsletter

Telephone-oriented attack delivery (TOAD) accounted for nearly 28% of all gateway-bypassing email detections across multiple enterprise environments between December 2025 and February 2026. These emails contain only a phone number as the payload, typically impersonating billing notifications from brands like PayPal or DocuSign, making them indistinguishable from legitimate business communications that secure email gateways filter out. The average detected attack combined more than four evasion techniques simultaneously, with over 1,400 unique evasion combinations tracked, representing a 130% increase over the previous study period.