How do phishing emails evade filters?

Content manipulation evades text-based detection: using images instead of text, employing character substitution, and randomizing content elements. Each message appears unique, defeating pattern matching.

Infrastructure rotation outruns blocklists: using many domains briefly, compromising legitimate sites for hosting, and leveraging cloud services for credibility. By the time one is blocked, attackers have moved.

Legitimacy piggybacking exploits trusted services: embedding malicious links in legitimate platforms (Google Docs, SharePoint), using compromised real accounts for sending, and timing attacks around genuine organizational events.