Beyond the Inbox: How Phishing Is Migrating to Your Web Forms

When most organisations think about phishing, they think about email. And email security has earned decades of investment — spam filters, DMARC, URL scanning, sandboxing, awareness training. The result is that email-based phishing, still dangerous, now runs a gauntlet of defences.

So attackers are doing what attackers always do: finding the path of least resistance. Increasingly, that path runs through your web forms.

The Form-Based Phishing Playbook

Form-based phishing exploits a simple truth: web forms are built to accept input from strangers, and what comes through them usually reaches a human reviewer with almost no security screening. Unlike email, which passes through layer after layer of filtering, form submissions often drop straight into CRM systems, support queues, and shared inboxes with no content evaluation at all.

The vectors are varied and getting sharper:

Contact form phishing

An attacker submits an enquiry through your contact form with a phishing URL dressed up as a legitimate business request: "I'm interested in your enterprise pricing — I've put our requirements in this document: [malicious URL]." The sales rep sees what looks like a qualified lead and clicks.

Support ticket weaponisation

Support forms are especially attractive because they are staffed by people trained to be helpful and fast. A message claiming to be a customer with a billing problem, complete with a link to a "screenshot," is very likely to get clicked by an agent focused on resolving the issue.

Registration and application form abuse

Forms that collect user-generated content — job applications, membership sign-ups, feedback — can be used to inject phishing URLs that then get stored in databases, emailed to administrators, or shown to other users. Your form infrastructure becomes a phishing distribution mechanism.

Review and feedback form exploitation

Public-facing forms that publish content — testimonials, reviews, community posts — can be weaponised to push phishing links to your own customers, straight through your own website.

Why Email Defences Miss Form-Based Attacks

Form-based phishing works precisely because it goes around the infrastructure organisations spent years building for email.

Email gateways, DMARC policies, and URL scanners operate on the email channel. They have no visibility into what comes through a web form. When a phishing URL arrives via a contact form instead of an inbox, it reaches its target without meeting any of the defences that would normally catch it.

That blind spot matters. IBM's 2025 Cost of a Data Breach Report found phishing to be the most common initial attack vector, responsible for 16% of all breaches, at an average of $4.8 million per incident. The World Economic Forum reported that 42% of organisations experienced phishing and social engineering attacks in 2024. As email defences keep improving, the share of these attacks flowing through alternative channels — web forms included — only grows.

Phishing is the #1 initial attack vector at 16% of all data breaches, costing $4.8 million per incident. As email defences improve, attackers increasingly route attacks through web forms. Sources: IBM, 2025 Cost of a Data Breach Report; WEF Global Cybersecurity Outlook 2025

The AI Factor in Form-Based Phishing

Generative AI has made form-based phishing more dangerous in two ways. First, it can generate submissions that are indistinguishable from genuine enquiries. A bot backed by a large language model can write a contact-form message that references your specific products, uses industry-appropriate language, and includes a personalised request — all wrapped around a malicious URL. Research in 2024 found AI-generated spear-phishing now matches expert human phishers for click-through, so when a submission looks like a real enquiry, the person processing it has no reason to suspect anything.

Second, AI enables volume. An attacker can generate hundreds of unique, contextually varied submissions across thousands of target sites in the time it once took to craft a single phishing email. Each one is different enough to slip past pattern-based detection, and each is tailored to the target form's fields and context.

The Downstream Damage

When form-based phishing succeeds, the consequences mirror email phishing — often with extra complications:

Consequence	Form-Specific Risk	Impact
Credential theft	Employee clicks a phishing URL from the CRM or support queue	Account compromise, lateral movement
Malware delivery	Attachment or link in a submission opened by staff	Ransomware, data exfiltration
Data breach	Compromised credentials used to reach systems	Average cost: $4.44M globally (IBM)
Reputational damage	Phishing content displayed on public-facing pages	Customer trust erosion, brand damage
Supply chain compromise	Phishing through vendor or partner application forms	Third-party breach (30% of all breaches — Verizon DBIR)

The Compliance Dimension

For regulated industries, form-based phishing adds exposure. If an attack through a web form leads to a breach, regulators will ask whether appropriate controls were in place to detect and prevent it. "We had email security but not form security" is unlikely to satisfy anyone during an investigation.

The EU's Digital Services Act, GDPR's requirement for appropriate technical measures, and sector rules like HIPAA all expect you to protect user data across every collection channel — not just email. Forms that accept and process input with no content-level security are exactly the kind of gap regulators are learning to look for.

Content-Level Protection for Forms

Defending against form-based phishing calls for the same principle that made email security effective: evaluate the content before it reaches a human. That means real-time scoring of every submission for phishing indicators — suspicious URLs, known malicious patterns, social-engineering language, and anomalous behaviour.

The technology to do this without adding friction already exists. Unlike a CAPTCHA, which tries to verify who is submitting, content-level moderation evaluates the submission itself. A real customer with a genuine enquiry notices nothing. A phishing attempt is flagged, scored, and either blocked or quarantined before it reaches your team.

For organisations that have poured resources into email security, form-level moderation closes the gap attackers are already using. Your forms are almost certainly being targeted right now. The only open question is whether you will see it.