Vendor email compromise exposes the limits of email authentication

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Real compromised accounts can defeat sender authentication and reputation checks while still delivering credential-harvesting lures.

Why it matters: It matters because email security and IAM teams need behavioral correlation, not just message authentication, when legitimate identities are abused to impersonate trusted business flows.

Context

Vendor email compromise is a social engineering pattern in which an attacker sends malicious email from a legitimate, already-compromised account. That breaks the usual assumption that authentication checks, sender reputation, and domain alignment are enough to separate trusted mail from abuse.

In this case, the identity problem is not isolated to email security alone. It reaches into human IAM, non-human identity trust, and tenant-to-tenant behaviour because the attacker used a real Microsoft 365 account, trusted infrastructure, and a plausible business pretext to bypass controls that were tuned for spoofing rather than account abuse.

The article’s central point is that message legitimacy and behavioural legitimacy are not the same thing. Once a trusted account is weaponised, the programme has to judge alignment between sender history, language, hosting, and recipient context, not just the message headers.

Key questions

Q: What breaks when a legitimate mailbox is used for vendor email compromise?

A: What breaks is the assumption that authentication equals trust. A real mailbox can pass SPF, DKIM, and DMARC while still delivering a malicious request, so teams must evaluate sender behaviour, destination context, and business plausibility before allowing user action.

Q: Why do vendor account compromises bypass many email security tools?

A: Vendor account compromise works because the attacker inherits a real sender identity, existing trust relationships, and often a valid conversation thread. Most tools are tuned to look for obvious malicious indicators, not for unusual behaviour inside otherwise legitimate communication. Once legitimacy is inherited, the message can pass as normal even when the intent is malicious.

Q: How can security teams tell whether email authentication is enough?

A: It is not enough when the sender account, domain, and communication style can all be genuine. If the decision to trust a message depends on identity context, recipient relationship, or unusual hosting choices, then authentication alone is only one input, not the control outcome.

Q: What should teams do when trusted vendor communications look normal but feel off?

A: Teams should compare the message against baseline behaviour for that sender, including language, timing, recipients, and destination domains. If the email is technically valid but behaviourally unusual, it should be treated as a likely abuse of trust rather than a harmless business message.

Technical breakdown

Why SPF, DKIM, and DMARC can still pass in vendor email compromise

SPF, DKIM, and DMARC validate whether the message came through authorised mail infrastructure and whether the content or sender domain was altered in transit. They do not tell you whether the authenticated account itself has been compromised or whether the sender’s intent matches normal business behaviour. In vendor email compromise, the attacker uses a real mailbox and a real domain, so the message is technically authentic even while the business action is malicious. The failure is structural: mailbox authentication is being asked to solve a trust problem it was never designed to solve.

Practical implication: Treat authentication as a transport control, not as a safety decision for user action.

How copy-paste URL lures defeat email security controls

Many secure email gateways and cloud email security tools rely on link rewriting, detonation, and URL analysis to inspect destinations before the user reaches them. A copy-paste instruction sidesteps that path by moving the final request outside the inspected click flow and into the user’s browser or phone. That matters because the message can look harmless in transit while the payload is only activated after manual navigation. In practice, the social engineering step is doing the technical bypass work, which means the control boundary shifts from message inspection to behavioural detection and user-context analysis.

Practical implication: Review whether your controls inspect only clicks, or also detect manual navigation instructions embedded in trusted mail.

Why trusted hosting changes the detection problem

When a credential portal sits on a widely trusted hosting platform, domain reputation tools lose much of their value because the infrastructure itself does not look obviously hostile. The attacker is exploiting borrowed trust from both the compromised sender and the hosting provider. That means the critical signal is no longer a bad domain alone, but the mismatch between the sender’s normal communication pattern and the destination’s lack of relationship to that sender or recipient. This is where vendor email compromise becomes a behavioural problem rather than a signature problem.

Practical implication: Correlate sender identity, hosting provenance, and recipient history before allowing the message to drive user action.

Threat narrative

Attacker objective: The attacker aims to capture credentials by turning a trusted vendor mailbox into a delivery channel for a fake login or document portal.

1. Entry occurs through a compromised Microsoft 365 mailbox belonging to a legitimate employee at a vendor, giving the attacker a trusted sending identity.
2. Credential-harvesting access is encouraged through a French-language document-sharing lure and a manual copy-paste URL instruction that pushes the victim off the protected click path.
3. Impact is credential theft from recipients who trust the sender, the signature, and the familiar business context, enabling follow-on account compromise.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.
• Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Vendor email compromise is an authentication problem only at the transport layer. SPF, DKIM, and DMARC answer whether a message passed through permitted infrastructure, not whether the sender identity has been weaponised. Once an attacker uses a legitimate mailbox, the trust signal is technically correct and operationally misleading. The practitioner conclusion is that authentication must be treated as necessary but insufficient for message trust decisions.

Behavioural correlation is the control family that changes the outcome. The article shows that no single indicator exposed the attack, but language, hosting mismatch, and cross-tenant patterning did. That is the real governance shift for email risk: organisations need detection that measures how an identity normally behaves, not only whether a message is syntactically valid. The practitioner conclusion is that identity-aware correlation belongs inside email defence, not beside it.

Borrowed trust is now the core email abuse pattern. This campaign did not need domain spoofing because the attacker inherited legitimacy from the compromised account and the hosting platform. That makes vendor email compromise a case study in trust transplantation, where the sender, signature, and infrastructure all look valid while the business request is malicious. The practitioner conclusion is that static blocklists cannot keep up with abuse that arrives through trusted channels.

Cross-tenant visibility is becoming a governance requirement for modern email defence. The same sender and pattern appearing across multiple protected environments shows how campaigns propagate before traditional indicators mature. That creates a new expectation for identity security programmes: if one tenant sees the behaviour, others should be able to benefit from the same behavioural evidence. The practitioner conclusion is that shared behavioural intelligence now matters as much as local policy.

Identity-aware email security is where NHI, human, and platform trust intersect. The attack path depends on a human recipient, a compromised human mailbox, and a cloud hosting platform that looks normal in isolation. That combination shows why identity security teams cannot separate email abuse from broader trust governance. The practitioner conclusion is that the trust graph, not the inbox alone, is the unit of analysis.

What this signals

Vendor email compromise is forcing email security to move from message validation to relationship validation. The useful question is no longer whether the sender authenticated correctly, but whether the message fits the sender’s normal business pattern and the recipient’s expected workflow. For programmes built around inbox filtering alone, that is a significant shift in detection philosophy.

Trust assumptions now need to be evaluated across identity, infrastructure, and communication behaviour at the same time. A valid account, a trusted hosting service, and a familiar-looking signature can coexist with malicious intent. That combination means practitioners should look for control overlap, not control isolation, when they assess email risk.

Manual-navigation lures are a useful named concept for this pattern: the attacker moves the payload from an inspected click into an uninspected copy-paste or browser-typed path. For email programmes, that means user education, behavioural analysis, and hosted-destination review all need to line up before the risk is visible.

For practitioners

• Harden mailbox abuse detection Correlate sender history, message language, recipient relationship, and sending pattern to identify when a legitimate mailbox is being used for abnormal vendor outreach.
• Detect manual navigation instructions Flag messages that instruct recipients to copy and paste URLs, especially when the destination is outside the sender’s normal vendor ecosystem.
• Track hosting provenance alongside domain reputation Treat a trusted hosting service as a signal to inspect, not to trust, when the portal domain has no historical relationship to the sender.
• Build cross-tenant behavioural correlation Share behavioural indicators across environments so the same compromised sender pattern can be recognised before it becomes a wider campaign.

Key takeaways

• Vendor email compromise works because a legitimate account can satisfy authentication checks while still being used for abuse.
• The attack described here combined a compromised Microsoft 365 mailbox, trusted-looking hosting, and behavioural mismatches that only emerged when signals were correlated.
• Email teams need to move beyond message validation and treat sender behaviour, destination provenance, and recipient context as the controls that actually change outcomes.

Key terms

• Vendor Email Compromise: Vendor email compromise is a form of impersonation that targets supplier, contractor, or partner relationships. Attackers exploit routine vendor communication patterns to request payment changes, invoice redirection, or other sensitive actions, so identity and process verification must extend beyond internal users.
• Behavioral Correlation: Behavioral correlation is the process of linking seemingly minor identity events into one campaign using shared attributes such as IP ranges, device signals, timing, and account relationships. It is the control layer that turns noisy telemetry into a coherent investigative picture.
• Manual Navigation Lure: A social engineering technique that asks the recipient to copy and paste a URL or otherwise leave the inspected click path. This reduces the effectiveness of link rewriting and sandboxing because the final request occurs outside the email security tool’s normal visibility.
• Trust Transplantation: A condition where an attacker inherits a trusted identity or channel and uses it to carry malicious content. In email abuse, the sender, signature, or hosting service may be genuine while the request itself is intended to deceive, which makes static reputation checks less reliable.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.