Anatomy of an Attack
Account Takeover (ATO)-based email attacks are among the toughest to detect—and the most devastating. Nearly 44% of businesses have fallen victim to ATO-based phishing and business email compromise (BEC) scams, which are launched from hijacked email accounts of trusted individuals.
PHASE 1
AcquisitionInitial Compromise
Cybercriminals collect email account credentials or user client access via phishing attacks or purchase credentials via the dark web.
Phase 2
ControlEstablish Persistence
The attacker then logs into the compromised account, changes account passwords or sets up a mail forwarder to establish control.
Phase 3
InfiltrationLog In, Lay Low
The attacker lays low, monitoring account activity and waiting patiently to hijack important conversations.
Phase 4
ExecutionLaunch Attack
78% of ATO-based attacks are phishing scams aimed at harvesting more credentials, but may include business email compromise or ransomware attacks.
Phase 5
ExfiltrationReap Rewards
Depending on the con, credentials are captured, sensitive data is ransacked, and stolen funds are retrieved.
