Anatomy of an Attack
Account takeover-based email attacks are among the toughest to detect—and the most devastating. Launched from compromised accounts of legitimate users, these attacks prey on the trust established amongst individuals.
PHASE 1
AcquisitionInitial Compromise
Cybercriminals collect email account credentials or user client access via phishing attacks or purchase credentials via the dark web.
Phase 2
ControlEstablish Persistence
The attacker logs into the compromised account and changes account passwords or sets up a mail forwarder to establish control.
Phase 3
InfiltrationLog In, Lay Low
The attacker monitors account activity and waits patiently to hijack important conversations amongst high-profile individuals.
Phase 4
ExecutionLaunch Attack
Most ATO-based phishing scams are aimed at harvesting more credentials, but attacks may involve a business email compromise scam or the spread of ransomware.
Phase 5
ExfiltrationReap Rewards
Depending on the con, credentials are captured, sensitive data is ransacked, or stolen funds are retrieved—all while making it appear that the attack is coming from a legitimate user.
