How do I hunt phishing campaigns across mailboxes?

How to build the hunt from the first message, not the first indicator

The fastest way to miss a campaign is to search too narrowly on sender address or subject line. Start with one confirmed phish, extract the behaviour that defines it, then query the mailbox estate for messages that share that method, not just that exact artefact. That is what makes the hunt resilient when attackers rotate infrastructure.

Look for the message features that survive reuse and relaying: lure structure, URL shape, reply-to mismatch, sender display changes, attachment style, brand impersonation and the wording of the call to action. Those cues let you pivot from a single report into a broader campaign view.

Phishing Guide is the best starting point when you need to turn one sample into a broader detection logic, because it covers phishing types, lures, kits and layered defences.

What to query across the full retention window

Use mailbox search to sweep the retention window for messages that match the technique you confirmed, then cluster results by shared traits. In practice that means searching on URL patterns, sender domains, lookalike domains, reply-to headers, subject variants, MIME or attachment patterns, and recurring language in the body or signature block.

Do not rely on a single IOC unless the campaign is very short-lived. Address-based hunting is still useful for cleanup, but campaign hunting works better when the query logic is broad enough to catch renamed sender infrastructure, forwarded copies and slightly modified templates.

Where the campaign is consistent, mailbox telemetry can also reveal staging. Repeated delivery to the same business unit, repeated use of the same content theme, or messages targeting the same workflow often show where the phish is being aimed before a user reports it.

Phishing Report Button and User Reported Message Triage Guide helps when you are clustering reported mail and want a repeatable way to preserve evidence while scaling the hunt.

How to separate campaign pattern from mailbox noise

The practical problem is false grouping. Some mail will look similar because it shares a vendor, a brand or a seasonal theme, but not because it belongs to the same adversary. The deciding question is whether the messages share a distinctive method of delivery or deception, not whether they merely resemble one another at a glance.

That is why campaign hunting should combine header analysis with content analysis. Headers help you see relay changes, sending infrastructure and reply-path manipulation. Content helps you see whether the attacker is reusing a lure, a business process impersonation or a credential-theft workflow across many targets.

Social Engineering Guide is useful here because it frames the recurring persuasion patterns that make phishing clusters easier to spot, especially urgency, authority and verification abuse.

Risk and Threat Considerations

Phishing campaigns are often designed to outlive individual indicators. Once infrastructure changes, a hunt built only on sender IPs, domains or subjects degrades quickly, while the campaign itself continues through revised lures and fresh delivery paths.

Failure mechanism: Attackers vary the transport layer but keep the behavioural pattern stable, so a narrow mailbox search misses the rest of the campaign and leaves exposed users, forwarded copies and later waves undiscovered.

Impact: Undetected sibling messages can extend the dwell time of the campaign, increase the chance of credential capture or token theft, and leave response teams cleaning up one message while the broader delivery pattern remains active.

Practitioner Guidance

What to prioritise: Build the hunt around the earliest confirmed phish that is well evidenced, then extract the method that defines the campaign. If you start with the right sample, your search logic can survive infra rotation and minor template edits.

What to verify: Before trusting a cluster, confirm that the messages share more than a superficial theme. Matching lure language, reply-path behaviour and URL construction are stronger signals than a common brand name or a similar subject line.

Decision rule: If the campaign is changing sender infrastructure faster than you can track it, move the hunt emphasis from sender indicators to behavioural indicators. If you still have stable URLs or attachment traits, use those as supporting filters rather than the sole basis for scope.

Practitioner takeaway: Good phishing hunts are pattern hunts, not indicator hoards, so the goal is to prove the attacker’s method and then look for every message that uses it.

Related resources from NHI Mgmt Group

• Mailboxes
• What breaks when attackers abuse compromised mailboxes and OAuth redirects in phishing campaigns?
• How should security teams hunt for long-running phishing campaigns that deliver RATs through cloud-hosted links and attachments?
• What should organisations do when a brand appears repeatedly in phishing campaigns across multiple months?