Nested message content is email text or data embedded inside another email, such as a forwarded message, delivery notice, or quoted reply. It may include links, instructions, or contact details that are separate from the outer message’s own text.
Attackers can use nested content to conceal phishing instructions within an otherwise legitimate notification or forwarding chain. Because the outer email may come from a trusted service, sender authentication alone does not show whether embedded text is safe. Defenders should inspect the full rendered message, including forwarded or attached message data, links, and redirects. Users should verify urgent requests through an independently obtained official channel rather than following instructions buried inside the message.