CEO impersonation in Microsoft 365 exposes the limits of native filters

At a glance

What this is: This guide explains how CEO impersonation attacks bypass native Microsoft 365 filtering and why layered controls are needed to catch display-name spoofing, lookalike domains, and behavioural deception.

Why it matters: It matters because impersonation turns email trust into an access and payment risk, and IAM teams need to harden identity-aware controls around mail flow, executive protection, and tenant-wide remediation.

By the numbers:

• Social engineering remains the third most common breach pattern, accounting for 16% of all confirmed breaches, according to Verizon 2026 Data Breach Investigations Report cited by IRONSCALES.
• The human element was present in 62% of breaches overall, according to Verizon 2026 Data Breach Investigations Report cited by IRONSCALES.

Context

CEO impersonation works because it exploits identity trust, not malware. Native mail security often focuses on signatures and malicious payloads, while business email compromise relies on display names, lookalike domains, urgency, and social context. That makes it a governance problem as much as an email security problem, especially where approval workflows depend on the apparent identity of the sender.

In Microsoft 365 environments, the practical gap is that spoofing, impersonation, mailbox intelligence, and remediation are separate control layers. Organisations that only tune spam and phishing filters tend to miss the layered identity signals that distinguish a real executive message from a convincing fraudulent one.

Key questions

Q: What breaks when executive impersonation is trusted inside normal workflows?

A: The break is not only fraud, but governance. Once staff accept an executive-looking message as sufficient authority, the organisation loses separation between identity verification and business execution. That can lead to unauthorized payments, changed banking details, and unsafe access resets. Identity teams should treat those workflows as control boundaries, not communications conveniences.

Q: Why do lookalike domains remain effective even when email authentication is in place?

A: Lookalike domains work because SPF, DKIM, and DMARC validate legitimacy for the domain being used, not for visually similar domains that attackers register themselves. That gap matters most when the lure is urgent and context-rich. Organisations need domain surveillance and takedown processes to catch abuse outside their own authenticated boundary.

Q: What are the signs that impersonation protection is too narrow?

A: If only exact spoofing is blocked while first-time senders, executive display names, and partner-domain lookalikes still reach inboxes, the control set is too narrow. Another warning sign is repeated analyst cleanup of the same impersonation pattern across multiple mailboxes.

Q: How should security teams respond when a CEO impersonation email is discovered?

A: Contain the message across the tenant, review who received it, and determine whether any payment, credential, or approval action was taken. Then tighten the executive protection list, verify authentication coverage, and review mail flow rules so the same pattern is blocked earlier next time.

Technical breakdown

Why impersonation bypasses native Microsoft 365 controls

Impersonation differs from exact spoofing because the attacker does not need to forge the real sender address. A lookalike domain, a matching display name, or a first-time sender using a familiar executive identity can pass many content-based filters. Native protections are strongest when they can evaluate known bad URLs, attachments, or exact-domain deception. When the message is plain text and socially plausible, the control must shift from content inspection to identity and relationship analysis. See the Phishing Guide.

Practical implication: Treat impersonation as an identity detection problem, not a spam-filter tuning exercise.

How mailbox intelligence changes detection logic

Mailbox intelligence builds a baseline of normal communication patterns for each user and executive. That lets the platform flag anomalous senders, unusual recipient relationships, or executive-style messages arriving from addresses the recipient has never engaged with before. This is useful because many impersonation attempts are not technically exotic. Their strength is contextual familiarity, which only becomes visible when the system compares a message against behavioural history rather than static rules.

Practical implication: Use behavioural baselines to surface first-time sender fraud attempts that traditional filters miss.

Why DMARC helps but does not close the impersonation gap

DMARC, SPF, and DKIM validate whether a message is authorised to use a specific domain. That blocks exact-domain spoofing, but it does not stop attackers from registering a lookalike domain or sending from an unrelated address that simply displays an executive name. In practice, email authentication removes the easiest deception path and forces attackers into higher-friction impersonation techniques, which then need mailbox intelligence and impersonation protection to catch them. See the Email Identity and BEC Guide.

Practical implication: Use authentication to narrow the attack surface, then rely on impersonation controls for the remaining deception methods.

Threat narrative

Attacker objective: The attacker wants the victim to authorise a payment or disclose credentials by making a fraudulent message look like an urgent executive request.

1. Entry occurs when an attacker sends a socially engineered email that imitates an executive through display-name spoofing or a lookalike domain.
2. Credential_harvested or trust-abused when the recipient accepts the sender as legitimate and complies with a request for funds or credentials.
3. Impact follows when the target transfers money, shares access, or bypasses normal approval steps, creating business email compromise and potential account compromise.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

CEO impersonation is an identity governance failure, not just an email hygiene issue. The attack succeeds by abusing organisational trust in executive identity, then using that trust to bypass approval discipline. That means the relevant control question is not whether a message looked spammy, but whether the organisation can verify who is actually requesting action. Practitioners should treat impersonation as a governance gap at the point of decision.

<> are still necessary, but they are insufficient without behavioural context. Authentication can block exact-domain spoofing, yet most executive impersonation campaigns move into lookalike domains and display-name deception. The gap is that static sender validation does not prove conversational legitimacy. Security teams need controls that understand who normally talks to whom, especially in finance and executive workflows.

Mailbox intelligence creates a useful named concept: the communication-pattern trust gap. That gap appears when a message looks familiar to a human but is unfamiliar to the receiving system's relationship model. The more an organisation relies on urgent email requests to move money or approve exceptions, the larger this gap becomes. Practitioners should close it with layered detection and verification, not by trusting human judgement under pressure.

Tenant-wide remediation matters because impersonation is a propagation problem as much as a detection problem. Once a fraudulent executive message lands in multiple inboxes, the risk is not limited to first contact. Clustering and bulk removal reduce exposure, but they also expose an operational truth: message-level detection is incomplete without coordinated cleanup across the tenant. Practitioners should align detection with removal workflows before a campaign spreads.

Microsoft 365 administrators need to think in terms of protected identity surfaces, not just protected mailboxes. The article's strongest lesson is that executives, subsidiaries, partner domains, and first-time senders all create different trust edges. Those edges should be governed as part of identity and access policy because the attack is exploiting identity recognition, not email delivery alone. Practitioners should map those identity edges explicitly.

From our research library:

• Impersonation fraud accounted for over 85% of all fraud attacks in 2025.

What this signals

Executive impersonation should be treated as a trust-boundary problem inside the mail system. The practical shift is from filtering obviously malicious content to governing who may plausibly ask for action. That means executive identities, partner domains, and approval workflows need explicit control coverage, not just inbox-level detection.

Communication-pattern trust gap: this is the space where a message looks familiar to a human but does not match the sender's normal relationship history. Organisations that rely on urgent email approvals should assume this gap will be targeted and should design verification steps that do not depend on inbox appearance alone.

The strongest programme signal is whether suspicious executive-style emails are being contained before a recipient can act on them. If remediation depends on manual inbox cleanup after delivery, the control model is still too reactive for modern business email compromise.

For practitioners

• Protect high-value executives first Add CEOs, CFOs, and other wire-transfer authorities to impersonation protection before expanding the policy to lower-risk users. Start where a single successful message would create the biggest financial or governance impact.
• Quarantine impersonation detections by default Set user impersonation, domain impersonation, and mailbox intelligence detections to quarantine so suspicious messages do not reach inboxes while analysts review them.
• Align SPF, DKIM, and DMARC records Publish and test authentication records with a quarantine or reject policy so exact-domain spoofing fails and attackers are forced into harder-to-execute impersonation techniques. See the Email Identity and BEC Guide.
• Create display-name spoofing rules Build transport rules that match external messages containing internal executive names and route them to quarantine, with exceptions for legitimate personal addresses used by leadership.
• Automate tenant-wide remediation Use clustered removal workflows so a fraudulent executive message can be deleted across all affected mailboxes before employees act on it.

Key takeaways

• Executive impersonation succeeds by abusing identity trust and conversational urgency, not by carrying obvious malware.
• Native Microsoft 365 controls can block some spoofing, but lookalike domains and display-name deception require additional behavioural and mailbox intelligence.
• The most effective defence is layered: authentication, impersonation protection, quarantine, and tenant-wide remediation all need to work together.

Related NHI Mgmt Group resources: Phishing Guide · Microsoft 365 Security Guide · Email Identity and BEC Guide · Ultimate Guide to NHIs: Key Challenges and Risks

Key terms

• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Mailbox Intelligence: Mailbox intelligence is a detection method that learns normal communication patterns and sender relationships for a user or organisation. It helps identify messages that are technically valid but unusual in context, such as an executive request from an unfamiliar address or a first-time sender using a trusted name.
• Domain Impersonation: Domain impersonation is the registration or use of a domain that mimics a trusted organisation’s brand, name, or web presence. Attackers use it for phishing, credential theft, and fraudulent payments. Defenders should compare certificates, WHOIS data where available, DNS patterns, and website content for signs of abuse.
• Display Name Spoofing: Display name spoofing is the practice of using a familiar or trusted name in an email field while the real sending address belongs elsewhere. It is effective because many users and systems focus on the visible name first. In AI-mediated workflows, this can mislead the model as well as the human recipient.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity governance to operational security decisions across modern programmes.