How do organisations detect spear phishing before account takeover?

How spear phishing gets detected before takeover

Early detection works by treating spear phishing as a chain, not a single email event. Message filters may catch obvious lures, but the stronger signal is when delivery telemetry and identity telemetry agree that something is wrong: a message arrived, a user interacted, and then the mailbox, login or forwarding behaviour changed in ways that do not fit the user’s normal pattern.

That is why good programmes look beyond sender reputation alone. The question is not only whether the email looked malicious, but whether it created observable post-delivery activity such as abnormal authentication, rule creation, delegation changes or unusual outbound mail. NHIMG’s Phishing Guide is useful background for the lure patterns, lookalike domains and attachment tricks that feed that detection pipeline.

Which signals matter most after the message lands?

The highest-value signals are the ones that show a shift from message delivery to account behaviour. These include impossible or atypical logins, new inbox forwarding rules, mailbox delegation grants, OAuth consent abuse, unusual session creation and unexpected outbound sends, especially when they occur shortly after a suspicious message was delivered or opened.

Message-level signals still matter because they explain the likely entry path. Lookalike domains, sender spoofing, urgent business language, HTML or SVG smuggling and links that redirect through trusted infrastructure can all indicate that the email was crafted to bypass user judgement and gateway controls. A detection stack works best when these artefacts are correlated with user action, not treated as separate problems.

At the identity layer, the concern is not only credential theft. Spear phishing often succeeds by inducing a user to authorise a malicious session, app, rule or delegation path that gives the attacker persistence without immediate password capture. Account Takeover Prevention Guide covers the session risk and post-login fraud patterns that are most useful once email delivery has already occurred.

What detection design works best in practice?

The most effective design is correlation across email, identity, endpoint and mailbox telemetry. That means alerting on suspicious mail delivery, then checking whether the recipient account shows authentication anomalies, rule changes, abnormal token use, privilege expansion or new sending behaviour. Separate tools can each miss the compromise; together they can show the sequence clearly enough to act before the attacker fully pivots.

Use that correlation to reduce false confidence in “clean inbox” thinking. A phishing email that bypasses the gateway but is followed by no behavioural change is lower risk than a mediocre lure that leads to a new forwarding rule, a delegated inbox or a sign-in from an unusual location. The practical objective is to detect the transition from attempted deception to account control.

For teams building that correlation, the operational lesson is to anchor detections on the account actions that matter most, not on message volume alone. Social Engineering Guide provides useful context on the human-pretext side, while the detection logic should be tuned to the downstream identity and mailbox changes that confirm the lure worked.

Risk and Threat Considerations

Spear phishing is dangerous because the compromise often looks ordinary at first. If an attacker gets a user to approve a malicious sign-in, create a forwarding rule or grant mailbox access, the email channel becomes a persistence channel and the account can be abused without a loud password-reset event.

Failure mechanism: The defender watches only for malicious content or blocked delivery, while the attacker uses a convincing message to trigger a legitimate user action that changes mailbox or identity state after the email is delivered.

Impact: The organisation can miss the handoff from lure to takeover, allowing inbox monitoring, internal impersonation, data theft and follow-on fraud before containment begins.

Practitioner Guidance

What to prioritise: Correlate message telemetry with identity and mailbox telemetry in the same detection workflow. If the email is suspicious and the account behaviour changes soon after, treat that as a stronger signal than either event on its own.

What to verify: Check whether the account created new forwarding, delegation or send-as settings, whether sign-ins came from an unusual device or location, and whether the user sent messages they normally would not send at that time or to those recipients.

Common mistake: Treating gateway filtering as the control objective. The better control objective is to detect the attacker’s post-delivery actions, because that is where takeover becomes visible.

Practitioner takeaway: The best spear-phishing detection is behavioural correlation, not message inspection alone, because the decisive evidence is usually the account change that follows the lure.

Related resources from NHI Mgmt Group

• Account Takeover
• How should security teams detect credential compromise before it turns into account takeover?
• How should security teams detect and respond to browser-based identity attacks before attackers turn stolen credentials into account takeover?
• How should organisations detect fraud rings before they turn into larger account takeover and payment fraud campaigns?