What Is Double Barrel Phishing? How the Two-Email Trust Trap Works (and How to Train Against It)

Double barrel phishing is a two-email attack. The first email is harmless and carries no link or attachment. Its only job is to start a conversation and earn your trust. The second email, sent into the same thread a little while later, is the real attack: it carries the malicious link, the credential-harvesting page, or the urgent request. By the time the dangerous message lands, it does not feel like it came out of nowhere. It feels like a reply.

That single shift, from a cold message to a warm one, is what makes the technique so effective. Most people have been trained to distrust the unexpected. Double barrel phishing, also called barrel phishing or conversational phishing, is built to defeat exactly that instinct.

What is double barrel phishing?

Double barrel phishing is a multi-stage social engineering method where an attacker sends two or more emails in sequence. The opening email looks benign and asks for nothing risky. It might say a document is on its way, that a colleague will follow up, or simply ask a low-stakes question. Once the target has read it, or even replied, the attacker fires the second barrel: the email that actually tries to steal credentials, money, or access.

The name comes from a double barrel shotgun, where the first trigger pull is followed quickly by the second. You will see the same attack described as “barrel phishing” and “conversational phishing.” They all point to the same idea: trust is built first, then weaponized.

This is different from a one-off phishing blast. A standard phishing email has to do everything in a single shot, which is why it so often leans on fear and urgency. Double barrel splits the work across two messages so that neither one looks alarming on its own.

How a double barrel phishing attack works

The attack runs in two clear stages.

Stage one, the lure. The attacker sends a clean email with no link and no attachment. Because there is nothing technical to flag, it slides past most email filters, which are tuned to catch malicious URLs and payloads. To the recipient it reads as normal business correspondence. A common pattern is a security or service notice, for example a message styled like a Google alert that says a new device just signed in to your account, with the device, location, and time spelled out. Nothing in that first email asks you to do anything. It just plants a thought: something may have happened with my account.

Stage two, the payload. A short time later, often minutes or hours, a second email arrives in the same thread. This one carries the hook. Following the example above, it is the “Was this you? Secure your account now” follow-up, with a button that leads to a fake sign-in page built to capture the password. Because it continues an existing conversation the recipient has already accepted as real, the usual alarm bells stay quiet. The thread itself has become the disguise.

Attackers can stretch this across more than two emails, add a fake reply from a “colleague,” or hijack a genuine thread they have already compromised. The mechanics vary. The principle does not: establish context, then exploit it.

Why double barrel phishing is so effective

Three things make this technique punch above its weight.

It beats content filters. The first email has no malicious link or file, so there is nothing for a gateway to block. By the time the payload arrives, the conversation already looks established, and many filters treat replies within an existing thread more leniently than cold inbound mail.

It exploits familiarity instead of fear. Classic awareness advice tells people to be suspicious of urgent, unexpected requests. Double barrel removes both triggers. The request is expected, because you were told it was coming, and it is not urgent in the first message at all. The attack works on trust, which is much harder to train away than panic.

It mirrors how attackers already operate. Social engineering sat behind 16% of breaches in the 2026 Verizon Data Breach Investigations Report, and the human element appeared in 62% of breaches overall. Pretexting, the practice of inventing a believable scenario to build trust before the ask, was a distinct initial-access vector in 6% of breaches and is exactly the muscle double barrel relies on.

Source: Verizon 2026 Data Breach Investigations Report, p. 10 to 12.

The volume context matters too. The Anti-Phishing Working Group recorded roughly 3.8 million phishing attacks across 2025, and phishing and spoofing was the most-reported crime type to the FBI Internet Crime Complaint Center, with 191,561 complaints in its 2025 report. Attackers have every incentive to keep refining techniques that get past both filters and people, and conversational, multi-stage lures do both.

Source: Anti-Phishing Working Group, Phishing Activity Trends Report, 2025. FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

Double barrel phishing vs. other phishing attacks

It helps to place double barrel next to the techniques people confuse it with.

Double barrel is best understood as a delivery tactic rather than a separate goal. An attacker can wrap it around spear phishing for precision, or around business email compromise to make a fraudulent payment request feel like the natural next step in a conversation. If you want to see how targeted single-shot attacks compare, our breakdown of spear phishing examples is a useful companion read.

A real-world style example

Picture an accounts payable specialist named Dani. On Tuesday morning a message arrives that looks like a routine account security notice: a new device has signed in, here are the device, location, and time, no action needed if it was you. Dani glances at it and moves on. Nothing to click, nothing to worry about.

A couple of hours later, a second email lands in that same thread. The tone shifts. “We could not confirm this was you. Secure your account now.” There is a button. Dani has already half-processed the first message as legitimate, so the follow-up feels like a continuation, not a fresh approach. One click later, Dani is on a sign-in page that looks exactly right and types in the password.

No single email in that sequence screamed danger. That is the entire design. The first message lowered the guard, and the second walked through the open door.

What this looks like in the wild (2025 to 2026)

This is not theory. In April 2026, Microsoft's Defender research team tracked a multi-stage campaign that hit more than 35,000 users across 13,000 organisations in 26 countries. The emails posed as an internal code of conduct review and opened with reassurance, not urgency: a banner claimed the message had been issued through an authorised internal channel and that its links were reviewed and approved for secure access. That manufactured trust is the lure. Only after it landed did the chain move people through a PDF, a CAPTCHA, and finally an adversary-in-the-middle page that captured their login tokens.

Source: Microsoft Security Blog, Breaking the code: multi-stage code of conduct phishing campaign leads to AiTM token compromise, May 2026.

The same build-trust-first pattern runs through the biggest incidents of the past year. Through 2025, Google's threat intelligence team tracked UNC6040, a group linked to ShinyHunters that opened with a friendly call or message impersonating IT support, then walked the victim into authorising a malicious app that drained their Salesforce data. It worked against well-known brands across retail, aviation, and technology. And when attackers compromise a real mailbox and simply reply inside an existing thread, the first email is genuine, which is conversational phishing in its purest form. Built on these staged plays, business email compromise drove roughly 3.05 billion dollars in reported losses in the FBI's 2025 report.

Source: Google Cloud Threat Intelligence (UNC6040), 2025. FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

How to defend against double barrel phishing

Stopping conversational attacks takes a mix of technical controls and trained people, because either one alone leaves a gap.

On the technical side, strengthen email authentication with SPF, DKIM, and DMARC so spoofed senders are harder to impersonate, and make sure your gateway evaluates links at click time rather than only at delivery, since the dangerous URL only appears in the second email. Phishing-resistant multi-factor authentication limits the damage when a credential does get captured. Encourage a simple verification habit for anything involving money or access: confirm through a second channel, such as a quick call, before acting.

On the human side, the key is that detection training has to look like the threat. If your simulations only ever send single, obvious emails, your people will only ever practice spotting single, obvious emails. They will not have seen a harmless first message followed by a payload, so they will not recognize the pattern when a real one arrives. This is also why measuring more than the click rate matters. Time to report and report rate tell you whether people are catching the sequence, not just avoiding one link. Our guide to phishing simulation metrics that actually matter goes deeper on this.

It is worth noting that attackers are making these conversations cheaper and more convincing with AI. In Microsoft's 2025 reporting, AI-assisted phishing achieved a 54% click-through rate against 12% for traditional phishing, roughly 4.5 times higher. The realism bar is rising, and training has to rise with it.

Source: Microsoft Digital Defense Report 2025 (Microsoft Incident Response and Defender dataset, not a global breach census).

How to simulate double barrel phishing with Keepnet

This is where the gap between knowing about an attack and being ready for it gets closed. The Keepnet Phishing Simulator includes a Double Barrel scenario that recreates the exact two-email sequence attackers use, so employees can experience it safely before a criminal sends them the real thing.

In practice, you build two templates on the Email Templates page. The first is the Lure: a trust-building message with no link, like the account notice in the example above. The second is the Payload: the follow-up that carries the simulated phishing link or landing page. When you launch the campaign, the Double Barrel Settings let you control the send order and the delay between the two emails, so the timing matches a realistic attack. You can read the setup steps in the Keepnet documentation.

Because the simulation reproduces the conversational structure, your reporting finally reflects how people behave under a realistic attack, not a contrived one. You can see who reported the lure, who only reacted to the payload, and how quickly the thread was flagged. If you are new to running these exercises, start with what a phishing simulation is and build from there. If you are weighing platforms, see how this capability compares in Keepnet vs KnowBe4.

Turn awareness into readiness

Double barrel phishing works because it hides the attack inside a conversation people have already chosen to trust. The fix is not more warnings about urgent emails. It is giving your team realistic practice with the exact two-stage pattern criminals use. See how the Keepnet Phishing Simulator runs Double Barrel scenarios across email and beyond, and build the instinct that spots the second barrel before it fires.