Account Takeover: Why Attackers Who Log In Like Staff Are Hard to Spot

Account takeover is one of the most insidious cyber threats facing businesses. When an attacker compromises a legitimate email account, they can pose as a trusted person or organisation without raising any warnings, and traditional email security sees nothing wrong. From there, they can steal money, take sensitive data or spread malware. Serious financial loss and reputational damage are common outcomes.

The lifecycle usually begins with stolen credentials, most often gained through phishing. Generative AI has made it easier to trick people into handing over login details, for example by posing as a colleague or sending them to a fake login page. Once inside, attackers are no longer in a hurry. They test and verify the stolen login, then see where it leads.

Kaseya's Dave Baggett notes that attackers once fired off spam and phishing straight away, but are now "getting clever". They sit tight, watch email traffic and wait for the right moment to join a conversation. After finding an organisation's weak points, they may use the account to target other employees and internal systems, such as payroll or invoicing databases. Their ultimate aim may be customers and suppliers, through outbound phishing that opens up a whole new range of targets. This is an extract of a longer sponsored feature, so it does not cover every detail.