Topic starter
23/10/2026 12:45 am
TL;DR: Trusted email accounts can turn into attack channels once credentials are abused, according to Adaptive Security. Identity telemetry and outbound monitoring have to be examined together when legitimate inboxes are used for phishing or data exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Adaptive Security: “Nikkei and the New Shape of Email Trust Attacks”.
By the numbers:
- A compromised Microsoft 365 account sent about 9,000 phishing emails on September 30 impersonating Nikkei staff.
- A separate Google Workspace account exposed information tied to 1,646 employees and business partners after unauthorized access from late July until August.
- Adaptive Security cites a peer-reviewed study of 113 million enterprise emails on how hijacked accounts enable lateral phishing.
Key questions
Q: Why do login anomalies and OAuth grants matter for email security?
A: They often reveal account compromise before malicious email is sent.
Q: What do security teams get wrong about kit-based phishing detection?
A: They often treat the kit name as the control boundary, but kits are now forked, mutated, and repackaged too quickly for that to be reliable.
Q: What breaks when attackers hijack trusted email accounts instead of spoofing domains?
A: Sender authentication still works, but it no longer protects the user from abuse of a legitimate identity.
Practitioner guidance
- Monitor high-trust accounts for outbound abuse Track send volume, recipient novelty, and unusual timing on executive, newsroom, finance, and communications accounts so a legitimate mailbox turning into a phishing source is visible early.
- Review OAuth grants and connected apps routinely Audit third-party applications with mailbox access, revoke unnecessary grants, and verify that consented access is still needed after password resets or role changes.
- Correlate login anomalies with message anomalies Join IAM telemetry with email security alerts so suspicious sign-ins, unfamiliar devices, and unusual send patterns are investigated as one compromise path.
Bottom line: A trusted email account can be more dangerous than an external phishing domain because it borrows the organisation’s own credibility and contact context.
Glossary terms: Lateral phishing, OAuth Grant, Trusted Account Abuse, Conditional Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Trusted-account abuse is now a governance problem, not just a phishing problem. Once an attacker controls a legitimate mailbox, the organisation’s own sender reputation becomes part of the attack surface. That changes the control question from “can we stop bad email?” to “can we prove who is operating a trusted identity right now?” Practitioner conclusion: outbound email abuse has to be governed as identity misuse.
A question worth separating out:
Q: How should organisations respond when a trusted account is misused?
A: They should contain the account, revoke connected access, reset credentials, and notify affected people and authorities with pre-approved communications. The response has to address both the visible abuse and the remaining access paths, especially OAuth grants and other delegated sessions that can survive a simple password change.
👉 Read our full editorial: Compromised email accounts turn trust into a phishing channel
This post was modified 6 days ago by NHI Mgmt Group