Compromised accounts and lateral phishing: are controls keeping up?

TL;DR: A compromised Microsoft 365 account sent about 9,000 phishing emails while a separate Google Workspace account exposed information tied to 1,646 employees and partners, according to Adaptive Security, illustrating how trusted inboxes become attack channels once credentials are abused. Prevention and detection have to be split between message analysis and identity controls, because account compromise and outbound impersonation are not the same failure.

Editorial analysis by NHI Mgmt Group, based on content published by Adaptive Security: “Nikkei and the New Shape of Email Trust Attacks”.

By the numbers:

• A compromised Microsoft 365 account sent about 9,000 phishing emails on September 30 impersonating Nikkei staff.
• A separate Google Workspace account exposed information tied to 1,646 employees and business partners after unauthorized access from late July until August.
• Adaptive Security cites a peer-reviewed study of 113 million enterprise emails on how hijacked accounts enable lateral phishing.

Key questions

Q: What breaks when attackers hijack trusted email accounts instead of spoofing domains?

A: Sender authentication still works, but it no longer protects the user from abuse of a legitimate identity.

Q: Why do login anomalies and OAuth grants matter for email security?

A: They often reveal account compromise before malicious email is sent.

Q: What do security teams get wrong about kit-based phishing detection?

A: They often treat the kit name as the control boundary, but kits are now forked, mutated, and repackaged too quickly for that to be reliable.

Practitioner guidance

• Monitor high-trust accounts for outbound abuse Track send volume, recipient novelty, and unusual timing on executive, newsroom, finance, and communications accounts so a legitimate mailbox turning into a phishing source is visible early.
• Review OAuth grants and connected apps routinely Audit third-party applications with mailbox access, revoke unnecessary grants, and verify that consented access is still needed after password resets or role changes.
• Correlate login anomalies with message anomalies Join IAM telemetry with email security alerts so suspicious sign-ins, unfamiliar devices, and unusual send patterns are investigated as one compromise path.

Bottom line: A trusted email account can be more dangerous than an external phishing domain because it borrows the organisation’s own credibility and contact context.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →