Topic starter
20/08/2026 6:05 pm
TL;DR: A compromised employee account was used to send internal phishing emails that standard alerts missed, while Expel’s MDR email coverage correlated unusual login location, recipient behavior, and mailbox changes to raise a critical incident. The case shows why internal-origin email abuse demands identity-aware detection, not just perimeter filtering.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Stories from the SOC: When threats come from inside the house”.
Key questions
Q: What breaks when campus phishing comes from a compromised internal account?
A: When a phishing message comes from a trusted campus account, users are more likely to click and some filters are less likely to stop it.
Q: Why do compromised mailboxes make internal phishing more effective?
A: A compromised mailbox converts an external threat into a trusted internal sender.
Q: What do security teams get wrong when they respond to email-borne attacks?
A: A common mistake is treating the email alert as the whole incident instead of the starting point.
Practitioner guidance
- Monitor compromised-account indicators across email and identity telemetry Correlate unusual sign-in location, atypical recipient sets, mailbox changes, and deletion activity so internal phishing is flagged as account abuse rather than a normal message.
- Treat mailbox rules as a security control surface Alert on new forwarding rules, hidden inbox filters, and bulk deletions because attackers use them to suppress evidence and preserve access after account takeover.
- Apply conditional access to reduce account-takeover blast radius Require risk-based authentication and session scrutiny when login patterns shift, especially for accounts that can send email internally and reach sensitive recipients.
Bottom line: A compromised mailbox can turn internal email into a high-trust delivery mechanism that evades external-phishing assumptions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:40 pm
Internal phishing is fundamentally an identity failure, not just an email problem. Once an attacker controls a legitimate account, sender trust becomes part of the attack surface and conventional inbound filtering loses much of its value. The relevant governance gap is whether identity events, mailbox changes, and recipient anomalies are correlated fast enough to reveal abuse. Practitioners should treat compromised-account email as an identity-detection problem with email as the delivery channel.
A question worth separating out:
Q: What should teams do after a mailbox is used to send malicious internal email?
A: They should disable the account, force a password reset, contain any endpoints that interacted with the message, and remove any remaining malicious email. After that, they should review authentication logs, mailbox rules, and access policies to prevent the same path from recurring.
👉 Read our full editorial: Internal phishing from a compromised account exposes a detection gap