Anatomy of an Attack

Account takeover-based email attacks are among the toughest to detect—and the most devastating. Launched from compromised accounts of legitimate users, these attacks prey on the trust established amongst individuals.

PHASE 1
Acquisition
Initial Compromise

Cybercriminals collect email account credentials or user client access via phishing attacks or purchase credentials via the dark web.

Phase 2
Control
Establish Persistence

The attacker logs into the compromised account and changes account passwords or sets up a mail forwarder to establish control.

Phase 3
Infiltration
Log In, Lay Low

The attacker monitors account activity and waits patiently to hijack important conversations amongst high-profile individuals.

Phase 4
Execution
Launch Attack

Most ATO-based phishing scams are aimed at harvesting more credentials, but attacks may involve a business email compromise scam or the spread of ransomware.

Phase 5
Exfiltration
Reap Rewards

Depending on the con, credentials are captured, sensitive data is ransacked, or stolen funds are retrieved—all while making it appear that the attack is coming from a legitimate user.

The Agari Advantage

Account Takeover Discovery

Detecting unauthorized users in legitimate email accounts or user clients is critical to defending against account takeover-based attacks.

Agari understands the complex information behind the email message and analyzes expected behaviors between sender and recipient to accurately determine if a message from a previously-established email account should be trusted. With protection for both internal and outbound email, Agari provides 360° security for all advanced threats.

 

white papers
White Paper
Protecting Against Account Takeover-Based Email Attacks
Learn more
analyst research
Analyst Research
Osterman Research: Solving Phishing, BEC, Account Takeovers and More
Learn more
Identity Deception Prevention

Convincing people into downloading malware or logging into a fake website is core to an ATO-based attack. Identity deception makes it difficult for the victim to know if the sender has malicious intent, and advanced attacks hijack the conversation at appropriate times so the recipient never suspects anything.

By understanding good email sending behaviors, Agari can spot anomalies and patterns that differ from the norm. Emails can be blocked based on the severity of divergence to ensure untrusted email never reaches the inbox.

Growing Smarter Every Day

It’s not enough to react and detect attacks from a compromised account, but to prevent and deter them before they strike. The Agari Identity Graph™ predicts attacks based on understanding the identity and relationships behind the message and on how closely a new message correlates or deviates from known good email communications.

Even though your business may not have seen a threat, Agari likely has. And because it’s at work already protecting organizations worldwide, it grows smarter and more effective each day.

white papers
White Paper
Agari Identity Graph™: The AI Engine Powering the Secure Email Cloud
Learn more

Featured Products

Agari Advanced Threat ProtectionTM

Stop sophisticated identity deception threats including business email compromise, executive spoofing, and account takeover-based attacks.

Learn more
Agari Incident ResponseTM

Accelerate phishing incident triage, forensics, remediation, and breach containment for the security operations center.

Learn more

Insights

Account Takeover Evolution Of advance Cyber attacks 2
Webinar
Account Takeover: The Evolution of Advanced Cyberattacks

Targeted email attacks continue to escalate as ...

Watch It Now
Blog Post
Agari Announces Insider Impersonation Protection Technology to Stop Internal Threats

As email scammers become more sophisticated and ...

Learn More
account-takeover-email
Analyst Research
ISMG: Account Takeover-Based Email Attacks

Traditional methods of identity deception are being ...

Learn More
London Blue Report
White Paper
London Blue Report

Nigeria has been a hub for scammers ...

Learn More
Blog Post
20% of Advanced Email Scams Now Launched from Hijacked Accounts

Recent increases in phishing, business email compromise (...

Learn More
Ebook
Q3 2019: Email Fraud and Identity Deception Trends

The continued evolution of business email compromise, ...

Learn More
Blog Post
Email ATO Attacks Surge 126%: Here's Why, and How to Stop It

Account takeover-based email scams are climbing fast ...

Learn More
Mail Letter

Would you like the confidence to trust your inbox?