Compromised email accounts turn trust into a phishing channel

At a glance

What this is: This is a case-based analysis of Nikkei’s email incidents, showing how compromised trusted accounts can be used for lateral phishing and unauthorized data exposure.

Why it matters: It matters because identity teams and security operations need to treat account compromise, message abuse, and OAuth or login anomalies as related but separate control problems.

By the numbers:

• A compromised Microsoft 365 account sent about 9,000 phishing emails on September 30 impersonating Nikkei staff.
• A separate Google Workspace account exposed information tied to 1,646 employees and business partners after unauthorized access from late July until August.
• Adaptive Security cites a peer-reviewed study of 113 million enterprise emails on how hijacked accounts enable lateral phishing.

Context

Email trust attacks exploit a simple governance gap: organisations often treat message content controls, account access controls, and user training as if they were one problem. In practice they fail differently. A compromised mailbox can send convincing phishing from a legitimate sender, while a separate unauthorized login can expose sensitive information long before anyone notices the outbound abuse.

Nikkei’s incidents show why identity and email security cannot be managed as isolated programmes. Compromised credentials, OAuth-connected access, and trusted sender abuse sit on the boundary between human identity governance, account hygiene, and phishing resilience. Once that boundary is crossed, the attacker inherits the organisation’s credibility, not just its inbox.

The pattern is not unusual. High-trust accounts are attractive precisely because recipients already trust the sender and the communication context. That makes the incident relevant to any organisation with recognizable brands, internal communications workflows, or third-party relationships that depend on email authenticity.

Key questions

Q: What breaks when attackers hijack trusted email accounts instead of spoofing domains?

A: Sender authentication still works, but it no longer protects the user from abuse of a legitimate identity. The attacker inherits thread context, recipient trust, and an authenticated sending path, which makes malicious messages look like normal business communication. That is why organisations need identity-aware detection and rapid containment, not just stronger mail filtering.

Q: Why do login anomalies and OAuth grants matter for email security?

A: They often reveal account compromise before malicious email is sent. Login anomalies can show unfamiliar devices, impossible travel, or suspicious timing, while OAuth grants can preserve access even after a password reset. If teams only inspect messages, they miss the account-level compromise that enables the later phishing campaign or data exposure.

Q: What do security teams get wrong about kit-based phishing detection?

A: They often treat the kit name as the control boundary, but kits are now forked, mutated, and repackaged too quickly for that to be reliable. A detection that keys off one kit’s code or branding can miss the same abuse pattern when it appears in a different wrapper. Behavioural mechanics are more durable than kit identity.

Q: How should organisations respond when a trusted account is misused?

A: They should contain the account, revoke connected access, reset credentials, and notify affected people and authorities with pre-approved communications. The response has to address both the visible abuse and the remaining access paths, especially OAuth grants and other delegated sessions that can survive a simple password change.

Technical breakdown

How lateral phishing works after mailbox compromise

Lateral phishing is not classic spray-and-pray phishing. The attacker first gains access to a real account, then uses that account’s history, relationship graph, and writing style to send believable messages to contacts the sender already knows. The value is not just the mailbox itself, but the trust baked into the account and the context stored inside it. That makes hijacked accounts effective delivery systems for fraud, credential theft, and further compromise. Because the message comes from a legitimate tenant, many email controls see a valid sender rather than a hostile actor. Practical implication: detect abuse patterns inside trusted accounts, not only external malicious content.

Practical implication: correlate send volume, thread history, and unusual recipient patterns to spot trusted-account abuse early.

Why login and OAuth controls matter before the phishing wave starts

Once an attacker has a valid session or abused OAuth grant, message-level filters are already late. Login anomaly detection looks for impossible travel, unfamiliar devices, or unusual authentication timing. OAuth app review matters because connected applications can preserve access even after a password reset if the grant is not revoked. Conditional access narrows where and how legitimate logins can happen, reducing the chance that a compromised credential becomes a usable launch point. These are identity controls, not email controls, and that distinction matters because the abuse often begins before any email is sent. Practical implication: treat OAuth inventory and login telemetry as first-line detection for trusted-account compromise.

Practical implication: review connected apps and risky sign-ins continuously, not only after outbound phishing is detected.

Why message detection and identity security solve different parts of the problem

Message-level detection is designed to inspect the email itself, looking for unusual tone, timing, content, or volume. Identity security is designed to verify that the sender should have been able to act at all. Those are complementary controls, but they answer different questions. If teams expect a content filter to catch a valid account that suddenly starts impersonating staff, they are outsourcing identity assurance to the wrong layer. Likewise, if identity controls are strong but no one watches outbound behaviour, a compromised account can still weaponise trust before anyone intervenes. Practical implication: separate ownership for outbound message abuse and account-access governance, then make them feed one response path.

Practical implication: align email security, IAM, and SOC workflows so abuse is investigated as one incident class.

Threat narrative

Attacker objective: Use trusted accounts to impersonate staff, expand phishing reach, and expose sensitive information tied to employees and business partners.

1. Entry occurred through compromised credentials or unauthorized account access in Microsoft 365 and Google Workspace.
2. Credentialed access let the attacker exploit the trust and contact context inside real organisational accounts.
3. The compromised Microsoft 365 account was then used to send about 9,000 phishing emails impersonating staff, while the Google Workspace account exposed information tied to 1,646 people.
4. The objective was to borrow organisational trust for phishing and to access sensitive information held in the email environment.

Breaches seen in the wild

• Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.
• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trusted-account abuse is now a governance problem, not just a phishing problem. Once an attacker controls a legitimate mailbox, the organisation’s own sender reputation becomes part of the attack surface. That changes the control question from “can we stop bad email?” to “can we prove who is operating a trusted identity right now?” Practitioner conclusion: outbound email abuse has to be governed as identity misuse.

Message filtering and identity assurance must be treated as separate control layers. Content inspection can catch strange wording, timing, and send volume, while login telemetry, MFA, OAuth review, and conditional access address the account compromise that enabled the message. The lesson is not that one control failed, but that the attack crossed two domains before detection. Practitioner conclusion: build detection paths that join email security and IAM evidence.

Lateral phishing is a named concept worth adopting because it captures the real failure mode. The attacker is not simply sending phishing from the outside; they are using the organisation’s own trusted account and embedded relationships to raise success rates. That makes credential hygiene, session control, and connected-app governance central to email defence. Practitioner conclusion: classify trusted-account abuse separately from generic phishing in your risk reporting.

Training should be a compensating control, not the primary defence. The article’s cited research shows that polished phishing can already look professional, so the burden on users should not be the main line of defence. Scenario-based simulations matter most when they teach recognition of impersonation from familiar senders. Practitioner conclusion: make training reinforce detection and response, not substitute for technical controls.

Identity governance for email environments needs lifecycle discipline. Accounts, sessions, and connected applications all extend the life of a compromise if they are not reviewed and revoked in concert. The practical concern is not just password reset, but what remains authorised after the reset. Practitioner conclusion: close the access path, not only the visible credential.

What this signals

Trusted-account abuse should be monitored as a separate incident class. When a legitimate sender becomes the delivery system, the issue is not merely phishing volume but compromised identity operating inside the organisation’s trust boundary. Practitioners should align mailbox abuse triage with IAM evidence so the response starts at the identity layer, not after the damage is visible.

OAuth review and conditional access are the overlooked controls in many email incidents. They reduce the chance that a stolen password or persistent app grant can continue to operate after the first compromise is discovered. That is where programme owners need to shift attention if they want earlier containment.

Scenario-based phishing training remains useful, but only as a supporting control. The article’s research references reinforce a familiar pattern: realistic simulations help users recognise impersonation, yet the decisive control is still the one that catches unauthorized account access before the message is sent.

For practitioners

• Monitor high-trust accounts for outbound abuse Track send volume, recipient novelty, and unusual timing on executive, newsroom, finance, and communications accounts so a legitimate mailbox turning into a phishing source is visible early.
• Review OAuth grants and connected apps routinely Audit third-party applications with mailbox access, revoke unnecessary grants, and verify that consented access is still needed after password resets or role changes.
• Correlate login anomalies with message anomalies Join IAM telemetry with email security alerts so suspicious sign-ins, unfamiliar devices, and unusual send patterns are investigated as one compromise path.
• Pre-write impersonation communications Prepare employee, partner, and regulator notification templates before an incident so the response team can disclose quickly when a trusted account is misused.
• Use realistic phishing simulations Build exercises around compromised trusted-sender scenarios, not generic link-click tests, so users practice spotting attacks that arrive from familiar accounts.

Key takeaways

• A trusted email account can be more dangerous than an external phishing domain because it borrows the organisation’s own credibility and contact context.
• The Nikkei incidents show why identity telemetry, OAuth governance, and outbound message monitoring need to be investigated together rather than in isolation.
• Training helps most when it complements technical controls that detect account misuse before impersonation emails reach recipients.

Key terms

• Lateral phishing: Lateral phishing is the use of a compromised internal account to send malicious messages to other users or partners. Because the sender is trusted, detection becomes harder and the attack can spread through familiar communication channels before controls react.
• OAuth Grant: An OAuth grant is the delegated permission an application receives to act on a user's behalf without storing the user's password. In NHI governance, it should be treated as a standing identity relationship with scope, ownership, and revocation requirements, not as a one-time setup detail.
• Trusted Account Abuse: The use of a legitimate, compromised identity to send malicious messages or perform unauthorized actions. Because the account already has reputation and context, defenders often miss it until the abuse spreads beyond the first target.
• Conditional Access: Conditional access is a policy model that decides whether an action should proceed based on context such as posture, resource sensitivity, timing, and scope. For AI agents, it must be evaluated at request time so a valid credential does not automatically equal permitted behaviour.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, identity lifecycle, and secrets management, including the control patterns that help teams reduce misuse of trusted accounts. It is designed for practitioners building stronger identity security programmes across human and non-human estates.