Topic starter
20/08/2026 5:56 pm
TL;DR: A single phishing-driven account compromise at a university escalated into 4,800 malicious emails, 40+ clicks, and inbox-rule-based concealment, according to Expel’s SOC analysis of the campaign. The case shows why identity correlation, not isolated alerts, determines whether defenders catch a contained phish or a broader account-abuse chain.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Stories from the SOC: The curious case of termination notices”.
By the numbers:
- The attacker used one compromised student account to send phishing email to 4,800 other users across the university.
- More than 40 recipients clicked the phishing link.
Key questions
Q: What breaks when phishing protection cannot quickly detect and remediate compromised accounts?
A: When detection and remediation lag, credential theft can spread from a single inbox compromise into repeated internal phishing and broader account takeover.
Q: Why do compromised user accounts increase phishing risk inside the organisation?
A: A compromised account can impersonate a normal colleague, which raises click likelihood and reduces detection.
Q: What are the signs that an email account has been turned into a phishing launchpad after compromise?
A: Common signs include unexpected inbox or forwarding rules, deleted security alerts, missing responses to phishing warnings, and internal messages that suddenly contain unusual urgency or authentication links.
Practitioner guidance
- Implement account-takeover correlation across identity and mail telemetry Join sign-in anomalies, mailbox rule changes, and outbound send spikes into one investigation workflow so one compromised account does not remain isolated from the wider campaign.
- Restrict mass-mail permissions to tightly governed accounts Limit send-at-scale capability to approved distribution lists or designated mailboxes, and review those privileges as elevated access rather than normal user convenience.
- Alert on suspicious inbox-rule creation and deletion Monitor for new mail rules that delete, hide, or redirect messages related to security alerts, phishing topics, or account activity because those rules often indicate concealment.
Bottom line: A single phished identity can become an internal phishing engine when the attacker inherits trusted sender status and message reach.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:36 pm
One compromised identity can become a trusted internal delivery platform. This case is not primarily about email as a channel. It is about authenticated access inheriting organisational trust and using that trust to widen the blast radius. That makes mailbox abuse a governance problem as much as a detection problem, because the attacker operated through legitimate accounts rather than obvious infrastructure. Practitioners should treat every successful phishing takeover as a potential distribution event, not a single-user incident.
A question worth separating out:
Q: Should universities treat mass email sending as a privileged access issue?
A: Yes. Large send capability should be governed like other elevated permissions because it can be abused to reach thousands of users from a single compromised account. The right model is explicit ownership, tight allowlisting, and monitoring for unusual sender behaviour rather than assuming every mailbox should be able to broadcast widely.
👉 Read our full editorial: Phishing account takeovers can cascade into campus-wide email abuse