Iran-aligned phishing campaigns expose identity gaps in the inbox

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Iran-aligned phishing operations use mailbox compromise, real-time token capture, and follow-on credential abuse to turn inbox access into cloud account takeover and destructive downstream activity.

Why it matters: It matters because identity teams have to govern phishing-resistant MFA, mailbox trust, and privilege handoff patterns together, not as separate controls.

Context

Iran-aligned phishing is not just a messaging problem. It is an identity problem that starts when a user trusts an inbox, a login prompt, or a mailbox sender relationship more than the actual authentication context behind it.

Abnormal AI describes a threat environment in which multiple Iran-aligned groups use email-led access, credential theft, and account takeover to move from initial compromise into cloud services, destructive activity, and credential resale. That makes inbox security part of IAM, not merely a user-awareness issue.

Key questions

Q: What breaks when organisations rely on OTP codes as the main defence against phishing?

A: OTP alone breaks when attackers can proxy the legitimate login session and harvest the code as the user enters it. In that case, the code proves the user saw a prompt, but it does not prove the request was initiated on the real site. Organisations then lose the assurance they expect from step-up authentication and remain exposed to unauthorized account access and transactions.

Q: Why do compromised mailboxes make internal phishing more effective?

A: A compromised mailbox converts an external threat into a trusted internal sender. That bypasses sender reputation controls, exploits colleague trust, and often produces higher click and response rates than outside phishing. For defenders, it means mailbox compromise must be handled as an identity control incident, not only as an email problem.

Q: How can security teams tell whether credential theft has moved into cloud persistence?

A: Look for MFA registration changes, new OAuth app consents, unusual sign-ins, and service principal or admin role changes after the initial compromise. Those actions indicate that stolen credentials are being converted into durable access rather than a one-time login. Identity telemetry is the clearest place to see that transition.

Q: Who is accountable when phishing leads to account compromise?

A: Accountability is shared, but security leadership owns the control environment that made impersonation succeed. Email authentication, browser trust configuration, access scoping, and incident reporting are governance responsibilities, not just end-user habits. If phishing can repeatedly turn into compromise, the control model is failing at the organisational level.

Technical breakdown

Why real-time phishing kits defeat TOTP and SMS MFA

Real-time phishing kits sit between the victim and the legitimate login flow, relaying credentials and MFA tokens through live WebSocket connections. Because the attacker uses the token before it expires, time-based one-time passwords and SMS codes no longer provide meaningful resistance. The security boundary shifts from password secrecy to session timing and token reuse, which is why phishing-resistant methods matter. Passkeys and FIDO2 security keys bind authentication to the legitimate origin and are not replayed the same way as shared secrets or one-time codes.

Practical implication: treat TOTP and SMS as insufficient for high-value accounts exposed to live phishing, and move those accounts to phishing-resistant authentication.

How compromised mailboxes bypass external sender filtering

When an attacker gains access to a legitimate mailbox, the next phishing message often arrives from a trusted internal account rather than an external domain. That bypasses many mail security assumptions because sender reputation, external filtering, and user trust all work in the attacker’s favour. This turns mailbox compromise into an amplification point: one compromised account can be used to phish coworkers, spread malicious links, or stage follow-on access without triggering the same friction as a standard inbound campaign.

Practical implication: treat mailbox compromise as a distribution mechanism and monitor for unusual internal sending patterns, not just inbound threats.

Why stolen credentials become cloud control plane access

Once credentials are harvested, the attacker often inherits access to email, documents, identity workflows, and connected SaaS tooling without deploying endpoint malware. That makes detection harder because the activity can look like ordinary cloud use unless identity telemetry is correlated across sign-in, mailbox, OAuth consent, and admin changes. In practice, one stolen login can be enough to modify MFA registrations, abuse delegated access, or create persistence in cloud environments. The control failure is not only initial authentication but also the lack of tight governance around post-login actions.

Practical implication: inspect identity telemetry after credential theft for MFA changes, OAuth consent abuse, and privilege escalation inside cloud platforms.

Threat narrative

Attacker objective: The objective is to convert inbox trust into persistent cloud access that supports espionage, disruption, or downstream criminal exploitation.

1. Entry occurs through phishing emails, malicious attachments, spoofed security notices, or compromised internal mailboxes used to reach additional victims.
2. Credential harvesting follows through fake login pages, browser stealers, and live token capture that intercepts passwords and MFA tokens before they expire.
3. Escalation happens when stolen credentials are reused to access cloud email, collaboration tools, OAuth grants, or MFA settings, creating persistence and broader account control.
4. Impact includes destructive wipes, data leakage, credential resale, and secondary attacks launched by other criminal actors using the same stolen access.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Inbox trust is now an identity control surface, not just a communication channel. The article shows that phishing succeeds when organisations treat email as separate from identity governance. Once a mailbox is trusted, it can be used to reset trust, redirect users, and extend the attack inside the collaboration stack. Practitioners should read inbox compromise as a governance failure across authentication, session trust, and delegated access.

Phishing-resistant MFA is no longer an edge-case control for high-risk users. Real-time token capture changes the economics of account theft because it defeats the controls many programmes still use as their default second factor. The article’s evidence supports a hard line: TOTP and SMS protect against convenience abuse, not against live adversarial relay. Security teams should treat FIDO2 and passkeys as the minimum acceptable option for exposed privileged identities.

Compromised mailboxes create identity relay chains that conventional filtering does not break. A trusted sender can turn an ordinary phishing message into an internal attack with much higher success rates than an external lure. That means mailbox security, not only email gateway policy, determines whether an organisation can contain lateral phishing. The practitioner conclusion is simple: identity telemetry has to extend into the inbox itself.

Credential resale shows why access governance must look beyond the first compromise. When stolen credentials are sold or handed off to other actors, the original phishing event becomes only the first phase of a broader identity abuse cycle. The governance implication is that ownership, revocation, and monitoring cannot stop at initial detection. Teams need to assume that one stolen login may outlive the original intrusion and reappear elsewhere.

Destructive follow-on operations expose a governance gap between access acquisition and access accountability. The article’s handoff model demonstrates that one actor can gain access while another executes the impact stage. That separation matters because it breaks the assumption that the first observed attacker is the only one that matters. Practitioners should treat delegated malicious access as a multi-actor identity problem, not a single-breach event.

What this signals

Phishing-resistant authentication should now be treated as a baseline control for any identity that can reach email, SaaS, or administrative settings. Live token capture changes the threat model because the attacker does not need to break MFA, only to race it. Teams that still reserve passkeys for a small pilot are leaving the highest-value identities in a vulnerable state.

Mailbox compromise is the bridge between social engineering and identity abuse. Once an attacker sends from a legitimate account, user trust and internal routing can do part of the attacker’s work. That means email security, identity telemetry, and helpdesk procedures need to be governed as one control system.

Credential theft in cloud-first environments now behaves like access brokerage. A stolen login can be reused, resold, or handed off for destructive activity, so the programme question is no longer whether the first compromise was blocked. The question is how quickly the organisation can revoke, re-issue, and verify trust after it happens.

For practitioners

• Deploy phishing-resistant MFA for exposed identities Require FIDO2 security keys or passkeys for executives, administrators, and anyone who can alter email, identity, or endpoint settings. Treat TOTP and SMS as insufficient for accounts likely to face live relay attacks.
• Monitor internal sender abuse and mailbox takeovers Add detections for unusual internal sending, suspicious forwarding changes, and new message patterns from accounts that rarely send mail externally. A compromised mailbox often becomes the next phishing source.
• Audit OAuth consents and MFA registration changes Review recent application consents, new MFA device registrations, and changes to service principals or privileged roles in the identity provider. These are the persistence points attackers use after credential theft.
• Tighten approval for destructive admin actions Require multi-admin approval for device wipes, RBAC changes, and other high-impact endpoint management actions. The article shows that once administrative access is reached, destructive actions can propagate quickly.
• Treat spam bombing as a precursor event Escalate sudden inbox flooding as a likely setup for helpdesk impersonation or credential reset abuse, not as a nuisance. The point is to block the social engineering chain before support channels are manipulated.

Key takeaways

• Iran-aligned phishing campaigns are exploiting a gap between email trust and identity trust, using mailboxes and live token capture to convert messages into account access.
• The article points to a multi-stage abuse pattern in which one actor steals access and another may later weaponise it for wipes, leaks, or resale.
• Phishing-resistant MFA, mailbox monitoring, and tighter post-login governance are the controls most directly aligned to the failure mode described.

Key terms

• Real-Time Phishing Kit: A real-time phishing kit proxies a victim’s login flow and captures credentials or MFA tokens as they are entered. In identity terms, it defeats codes that are only valid for a short window because the attacker can replay them immediately within the same session.
• Mailbox compromise: Mailbox compromise occurs when an attacker gains control of an email account or can act within it as if they were the legitimate user. In identity terms, it turns email into an abuse channel for fraud, lateral trust exploitation, and policy bypass unless the organisation can detect and contain the takeover quickly.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Identity Relay Chain: An identity relay chain is the sequence in which one compromised account, token, or mailbox is used to gain more access through trusted workflows. It is especially dangerous because the attacker can move from initial compromise to internal trust exploitation without needing malware on every endpoint.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.