Topic starter
27/06/2026 1:49 pm
TL;DR: Iran-aligned threat groups are using email, real-time phishing kits, and compromised mailboxes to steal credentials, bypass standard MFA, and spread destructive access across cloud environments, according to Abnormal AI and multiple threat intelligence sources. The underlying problem is not just phishing volume but identity trust that still assumes human-paced review and revocation.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Tracking Iran-Aligned Cyber Operations Following U.S.-Israel Strikes”.
Key questions
Q: What breaks when organisations rely on OTP codes as the main defence against phishing?
A: OTP alone breaks when attackers can proxy the legitimate login session and harvest the code as the user enters it.
Q: Why do compromised mailboxes make internal phishing more effective?
A: A compromised mailbox converts an external threat into a trusted internal sender.
Q: How can security teams tell whether credential theft has moved into cloud persistence?
A: Look for MFA registration changes, new OAuth app consents, unusual sign-ins, and service principal or admin role changes after the initial compromise.
Practitioner guidance
- Deploy phishing-resistant MFA for exposed identities Require FIDO2 security keys or passkeys for executives, administrators, and anyone who can alter email, identity, or endpoint settings.
- Monitor internal sender abuse and mailbox takeovers Add detections for unusual internal sending, suspicious forwarding changes, and new message patterns from accounts that rarely send mail externally.
- Audit OAuth consents and MFA registration changes Review recent application consents, new MFA device registrations, and changes to service principals or privileged roles in the identity provider.
Bottom line: Iran-aligned phishing campaigns are exploiting a gap between email trust and identity trust, using mailboxes and live token capture to convert messages into account access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:17 pm
Inbox trust is now an identity control surface, not just a communication channel. The article shows that phishing succeeds when organisations treat email as separate from identity governance. Once a mailbox is trusted, it can be used to reset trust, redirect users, and extend the attack inside the collaboration stack. Practitioners should read inbox compromise as a governance failure across authentication, session trust, and delegated access.
A question worth separating out:
Q: Who is accountable when phishing leads to account compromise?
A: Accountability is shared, but security leadership owns the control environment that made impersonation succeed. Email authentication, browser trust configuration, access scoping, and incident reporting are governance responsibilities, not just end-user habits. If phishing can repeatedly turn into compromise, the control model is failing at the organisational level.
👉 Read our full editorial: Iran-aligned phishing campaigns expose identity gaps in the inbox