What happens after attackers get access to a legitimate email account through phishing?

Once an account is compromised, attackers can read sensitive emails, harvest internal context, impersonate the user, and abuse trust to launch business email compromise or vendor fraud. They may also target third party apps connected to the mailbox. The longer access remains undetected, the more likely the intrusion becomes a wider operational and financial incident.

What happens after a phishing compromise turns a mailbox into a trusted foothold?

Once an attacker controls a legitimate inbox, the mailbox becomes both a source of intelligence and a launch point. They can quietly review conversation history, infer business processes, exploit existing trust relationships, and blend malicious replies into normal threads. In practice, the most damaging step is often not the initial login but the attacker’s ability to operate as the user without triggering suspicion.

A compromised mailbox also changes the attacker’s options beyond simple email theft. They can reset passwords for connected services, pivot into third-party applications that trust the account, and use the inbox to approve or redirect sensitive requests. That is why email compromise often develops into a broader account-takeover event rather than staying confined to messaging.

Time matters because each hour of undetected access increases the attacker’s visibility into contacts, payment workflows, and vendor patterns. The longer the compromise persists, the more likely it is to produce impersonation, invoice fraud, data exposure, or follow-on compromise of adjacent systems.

Why legitimate access is more dangerous than obvious spam

A phishing attacker does not need to break email security controls once the user has already done the hard part for them. With real credentials or a valid session, messages come from a trusted address, conversation threads provide context, and recipients are less likely to challenge unusual requests. That trust advantage is what turns a single mailbox compromise into a high-yield business email compromise path.

Attackers often exploit the mailbox as an intelligence source before they act. They look for payment terms, executive assistants, supplier names, recurring invoice patterns, and internal escalation habits. That context lets them craft convincing requests, time their messages to avoid scrutiny, and impersonate the victim in ways that are much harder to spot than generic phishing.

Connected applications expand the blast radius. If the mailbox is used for single sign-on, password reset, ticketing, document sharing, or SaaS notifications, the compromise can reach far beyond email itself. For the same reason, mailbox access should be treated as a privileged trust relationship, not just a communications problem.

How attackers usually turn inbox access into broader fraud or compromise

The common sequence is reconnaissance, impersonation, and monetization. First, the attacker reads mail to understand relationships and find useful approvals, then they send believable messages from the victim’s account or from lookalike threads. After that, they may alter payment instructions, request urgent wire transfers, or redirect vendors to new bank details. This is why phishing-led compromises often look like ordinary business activity until the financial loss is already underway.

They also search for recovery paths and service integrations. Mailbox rules, forwarding settings, app authorizations, and OAuth-consented tools can keep the attacker present even after the password changes. Where those connections exist, the compromise is no longer just a stolen login, it is a persistence problem.

More advanced actors use the mailbox as an entry point into third-party risk. If vendors, payroll providers, or shared collaboration tools trust messages from the account, the attacker can trigger actions outside the mailbox and make the incident operationally much larger than the original phishing lure.

Risk and Threat Considerations

A legitimate mailbox is valuable because it combines trust, continuity, and access to sensitive context. That makes it an ideal platform for stealthy fraud, internal reconnaissance, and secondary compromise, especially when the account is linked to payment workflows or external applications.

Failure mechanism: The attacker abuses a real identity to inherit existing trust, then uses thread history, reset links, forwarding rules, and connected-app permissions to extend control and persist after the initial phish.

Impact: The likely outcomes are business email compromise, vendor fraud, data exposure, credential resets, and wider operational loss if the mailbox is used to authorize or route sensitive business actions.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1586 — Compromise Accounts	Mailbox takeover is an account-compromise attack path.
	T1114 — Email Collection	Attackers read mail to harvest context and targets.
	T1539 — Steal Web Session Cookie	Phishing can preserve access through stolen sessions, not just passwords.
Recommendation — Map mailbox abuse to account compromise and hunt for post-login persistence and misuse. Monitor for suspicious mailbox access and bulk message collection. Invalidate stolen sessions and review auth logs after phishing.
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	Limits what a compromised mailbox can reach or approve.
	IA-2 — Identification and Authentication (Organizational Users)	Compromised user authentication is the entry point for mailbox abuse.
	AU-6 — Audit Review, Analysis, and Reporting	Mailbox compromise needs reliable review of access and message activity.
Recommendation — Restrict mailbox and connected-app privileges to the minimum needed. Require strong user authentication and reauthentication for sensitive actions. Review mailbox and sign-in logs for abnormal access and message actions.
CIS Controls v8	CIS-5 — Account Management	Phishing turns valid accounts into attacker-controlled assets.
	CIS-8 — Audit Log Management	Detection depends on mailbox, sign-in, and rule-change visibility.
Recommendation — Track account exposure, disable compromised access, and remove stale trust paths. Centralize logs for mailbox access, forwarding, and authentication events.
OWASP API Security Top 10	API2 — Broken Authentication	Compromised mailbox sessions and tokens are an authentication failure mode for connected services.
	API5 — Broken Function Level Authorization	Attackers abuse trusted accounts to perform actions they should not control.
Recommendation — Revoke compromised tokens and harden authentication for connected applications. Validate that sensitive actions require explicit authorization, not mailbox trust alone.

Practitioner Guidance

What to prioritise: Treat the incident as an account-takeover investigation, not a mailbox cleanup. The first question is whether the attacker retained access through forwarding, inbox rules, OAuth grants, or reset-capable sessions, because those are the paths most likely to sustain harm.

What to verify: Confirm whether the account has been used to send messages, approve transactions, or authenticate to downstream services. Also verify whether finance, procurement, or executive workflows rely on the mailbox for identity confirmation, since that determines the urgency of fraud containment.

Practitioner takeaway: The core risk is not that an attacker can read email, it is that they can borrow a trusted business identity long enough to make fraudulent actions look routine.