Why 'Call This Number' TOAD Emails Beat Gateways
Dark Reading, Wednesday, February 25th, 2026
Attackers are bypassing email gateways through telephone-oriented attack delivery (TOAD), in which the only email payload is a phone number.
While much of the conversation surrounding phishing concerns not clicking a suspicious link or downloading a malicious attachment, there's an attack technique gaining prominence in which the email payload consists of nothing but a phone number. And these emails are getting past defenses.
Researchers from email security vendor StrongestLayer today published an analysis of roughly 5,000 email-based threat detections that bypassed secure email gateways across multiple enterprise environments between December 2025 and now.