Topic starter
27/06/2026 1:47 pm
TL;DR: Vendor email compromise attacks can pass SPF, DKIM, and DMARC while still delivering credential-harvesting lures, because the sender account, domain, and infrastructure are genuinely trusted, according to Abnormal AI. The operational lesson is that identity-aware behavioral correlation matters more than single-message authentication when compromised accounts are used from within.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “French-Language VEC Attack Exploits Compromised Vendor Account and Cloudflare-Hosted Portal”.
Key questions
Q: What breaks when a legitimate mailbox is used for vendor email compromise?
A: What breaks is the assumption that authentication equals trust.
Q: Why do vendor account compromises bypass many email security tools?
A: Vendor account compromise works because the attacker inherits a real sender identity, existing trust relationships, and often a valid conversation thread.
Q: How can security teams tell whether email authentication is enough?
A: It is not enough when the sender account, domain, and communication style can all be genuine.
Practitioner guidance
- Harden mailbox abuse detection Correlate sender history, message language, recipient relationship, and sending pattern to identify when a legitimate mailbox is being used for abnormal vendor outreach.
- Detect manual navigation instructions Flag messages that instruct recipients to copy and paste URLs, especially when the destination is outside the sender’s normal vendor ecosystem.
- Track hosting provenance alongside domain reputation Treat a trusted hosting service as a signal to inspect, not to trust, when the portal domain has no historical relationship to the sender.
Bottom line: Vendor email compromise works because a legitimate account can satisfy authentication checks while still being used for abuse.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:15 pm
Vendor email compromise is an authentication problem only at the transport layer. SPF, DKIM, and DMARC answer whether a message passed through permitted infrastructure, not whether the sender identity has been weaponised. Once an attacker uses a legitimate mailbox, the trust signal is technically correct and operationally misleading. The practitioner conclusion is that authentication must be treated as necessary but insufficient for message trust decisions.
A question worth separating out:
Q: What should teams do when trusted vendor communications look normal but feel off?
A: Teams should compare the message against baseline behaviour for that sender, including language, timing, recipients, and destination domains. If the email is technically valid but behaviourally unusual, it should be treated as a likely abuse of trust rather than a harmless business message.
👉 Read our full editorial: Vendor email compromise exposes the limits of email authentication