Internal Phishing: How to Respond When an Attack Originates from a Colleague's Inbox

It is a nightmare scenario for any CISO. On a typical morning, dozens of employees receive an email featuring a suspicious login link or an urgent attachment. The sender address contains zero typos, the domain matches the corporate namespace perfectly, and SPF, DKIM, and DMARC checks pass with flying colors. The reason is simple: the attack is not inbound from an external infrastructure, but sent directly from the legitimate mailbox of a coworker whose credentials were compromised.

When an adversary penetrates a Microsoft 365 or Google Workspace tenant, immediate data exfiltration is rarely the only objective. Attackers routinely focus on lateral movement, exploiting the implicit trust granted to internal corporate communications. Against this vector, traditional perimeter email security gateways offer little resistance. Rapid detection depends on workforce situational awareness and strict adherence to defensive playbooks.

How should employees react when a suspicious email arrives from a legitimate coworker address?#

Quick Answer: Never click Reply to verify an email's authenticity. Immediately validate the request with the sender through an out-of-band communication channel (such as a direct phone call or face-to-face interaction) and forward the threat directly to SecOps or the IT help desk to isolate the compromised account.

When faced with a strange request, an employee's instinctive reaction is often to click "Reply" and ask: "Did you actually send this?". This is a critical operational mistake. If an attacker controls the mailbox session, they see the incoming reply and will quickly confirm the request to disarm suspicion. In many cases, threat actors configure hidden inbox forwarding rules to intercept and purge security-related inquiries before the legitimate user ever notices them.

To interrupt the attack chain, staff must execute two immediate procedures:

• Out-of-Band Verification: Contact the purported sender via an independent communication path. Call their direct corporate line or walk over to their desk if working in the same facility.
• Immediate Security Escalation: Use the integrated mail client phishing report button, or attach the suspicious message as an RFC 822 file (.eml or .msg) directly to the security operations team to preserve raw email headers for forensic triage.

What behavioral indicators signal an internal account takeover despite a valid sender address?#

Quick Answer: Detection hinges on behavioral analysis of the message: sudden shifts in writing style, unwarranted urgency, unexpected links to external cloud drives, and thread hijacking where malicious payloads are dropped into dormant discussions.

While internal spoofing leverages institutional trust, adversaries consistently introduce contextual anomalies. An attacker hijacking an active session rarely understands the victim's interpersonal history, organizational culture, or unique communication style.

Several indicators should immediately trigger heightened suspicion:

• Deviations from Standard Tone: A teammate who communicates casually suddenly adopts formal greetings, rigid enterprise phrasing, or unnatural syntax.
• Artificial Urgency and Coercion: The message fabricates high-stakes deadlines, such as an overdue critical invoice, an immediate IT access termination, or an urgent executive NDA that requires an electronic signature within the hour.
• Unusual Credential Solicitations: The email points to a login portal mimicking a SharePoint, OneDrive, or Google Workspace prompt to view an ostensibly routine document.
• Thread Hijacking: The attacker inserts a malicious lure into an inactive email thread from weeks or months prior, taking advantage of the established conversational history.

Why does internal phishing accelerate lateral movement across enterprise networks?#

Account-to-account phishing represents one of the most effective escalation vectors inside an organization. Once a threat actor secures an initial foothold (often via adversary-in-the-middle session cookie theft), they gain unrestricted access to the global address list (GAL).

From there, attackers map out high-value targets, including payroll specialists, HR directors, and system administrators. Within minutes, tailored lures land in the inboxes of privileged users. Because the email originates internally, targets exhibit a significantly lower level of skepticism than they would apply to external communications.

To neutralize this exposure, organizations must look beyond passive compliance lectures. Experiential workforce training using authentic threat models is paramount. With our Super Phisher simulation platform, deployed alongside our team, security leaders can subject personnel to high-fidelity social engineering scenarios that accurately simulate internal account compromises and lateral pivots, reinforcing muscle memory before an actual breach occurs.

BRAIN SECURITY PRODUCT IN ACTION · Super Phisher

What incident response procedures should SecOps trigger upon receiving an alert?#

When an internal phishing incident surfaces, response teams must act within minutes to contain the blast radius and stop secondary compromises across the tenant:

• Immediate Session Revocation: SecOps must reset the compromised account credentials and invalidate all active user sessions, refresh tokens, and OAuth grants across enterprise identity providers.
• Inbox Rule Auditing: Attackers routinely implement inbox rules to automate persistence (such as forwarding copies externally or moving messages containing "phishing," "fraud," or "password" to the RSS Feeds or Deleted Items folders). These configurations must be audited and cleared.
• Global Message Purge: Utilizing administrative tooling (such as Microsoft 365 Content Search or Google Workspace investigation utilities), administrators must run a hard delete across all tenant mailboxes that received the malicious message to prevent subsequent interactions.
• Forensic Sign-in Analysis: Correlate authentication logs, IP addresses, geographical anomalies, and client user-agent strings to determine the precise point of initial access and identify what internal resources were accessed during the breach window.

Defending an organization against lateral account-takeover attacks requires continuous alignment between mail security controls and employee vigilance. To build a targeted cyber training program aligned with your actual operational risks, book a demo and discuss your defensive roadmap with the specialists at Brain Security.

Further reading: related articles and Brain Security solutions#

Related articles on this topic

• Remote Work, Transit, and Hotels: 6 Mobile Cybersecurity Mistakes Exposing Your Enterprise (Phishing & Social Engineering) : Protect your distributed workforce from rogue Wi-Fi, shoulder surfing, and juice jacking. Build resilient security hygiene for employees on the go.
• Infostealers: Why Saving Corporate Passwords in Unmanaged Browsers Is a Critical Risk (Phishing & Social Engineering) : Learn how infostealer malware steals corporate credentials and session cookies from unmanaged web browsers to bypass MFA and breach your systems.
• Scareware and Fake Browser Alerts: Train Employees to Spot Web Threats (Phishing & Social Engineering) : Block scareware and fake browser alerts. Discover how ClickFix exploits human trust, and empower employees to secure their browsers daily.
• PCI DSS v4.0 Requirement 12.6: Upgrading Phishing Awareness (Compliance (NIS 2, DORA, ISO)) : Learn how PCI DSS v4.0 Requirement 12.6 reshapes security awareness training, social engineering defense, and QSA audit compliance.

Explore Brain Security solutions on our website

• Featured solution : Super Phisher : The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.
• Browse use cases by security goal and industry
• Compare our cybersecurity and AI awareness formats
• Explore the full interactive Brain Security catalog
• Discuss your needs with our team (demo and setup)