How do security teams know if internal phishing is spreading beyond the first account?

Why This Matters for Security Teams

Internal phishing stops being a single-account problem the moment the compromised mailbox is used to distribute the lure, reset trust, or harvest follow-on credentials. That is why mailbox telemetry alone is not enough. Security teams need to correlate message patterns, authentication anomalies, and recipient behavior to determine whether the campaign is spreading laterally inside the environment.

This matters because the blast radius often expands before an alert is raised. A compromised account can reply in-thread, reuse familiar subjects, or target trusted contacts, which makes the message harder to spot and more likely to be opened. NHI Management Group notes that only 5.7% of organisations have full visibility into their service accounts in The Ultimate Guide to NHIs, and the same visibility gap often appears in internal identity investigations.

For security teams, the practical question is not whether one inbox was compromised, but whether the account has become an internal delivery mechanism that can reach more users, more systems, or both. In practice, many security teams discover campaign spread only after multiple recipients have already engaged with the lure, rather than through intentional containment.

How It Works in Practice

The fastest way to assess spread is to join three views: mailbox activity, identity events, and recipient impact. Start by clustering messages with the same or highly similar subject lines, sender display names, links, and attachment hashes. Then check whether the sending account shows unusual sign-in locations, impossible travel, fresh token issuance, MFA resets, or mailbox rule creation. Finally, compare who received the lure, who clicked, and who authenticated soon after.

This approach aligns with the control logic in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially when organizations need to correlate detection, logging, and response across multiple data sources. It also fits the NHI reality described by CoPhish OAuth Token Theft via Copilot Studio, where token abuse and internal delivery can extend the compromise beyond the first account.

• Look for repeated subjects or reply chains that are reused across multiple internal recipients.
• Flag bursts of clicks or authentication attempts within a short time window after the first delivery.
• Inspect mailbox rules, forwarding changes, and OAuth grants that indicate persistence.
• Correlate sign-in logs with message timestamps to see whether a sender is operating interactively or automatically.

When the same lure reaches multiple users, the key question is whether the source account is still under direct human control or has become a relay point for token theft, mailbox abuse, or delegated access. That distinction matters because internal spread often hinges on trusted identity paths, not just malicious content. These controls tend to break down in heavily federated environments with incomplete mailbox telemetry and delayed identity log ingestion because the sequence of compromise cannot be reconstructed quickly enough.

Common Variations and Edge Cases

Tighter correlation often increases investigation overhead, requiring organisations to balance faster containment against the noise created by legitimate internal campaigns, helpdesk mail, and auto-forwarding workflows. There is no universal standard for exactly how many matching signals prove spread, so current guidance suggests using a threshold-based triage model rather than a single indicator.

Some environments complicate the picture. In shared mailboxes, service accounts, or automation-heavy workflows, a single account may legitimately contact many recipients in a short period. In those cases, investigators should look for deviations from the baseline, such as a new sender IP, new OAuth consent, or unusual message formatting rather than volume alone. That is especially important where NHI-related abuse is already likely, since the broader research shows many organisations lack visibility into service accounts and third-party connections.

For deeper context on identity-driven spread, see Poland Military Breach. The main operational edge case is a compromised account that sends from an internal alias or delegated mailbox, because the originating identity can be hidden even while the campaign is actively expanding.

Related resources from NHI Mgmt Group

• How do security teams know if a suspicious package touched a Lambda environment?
• How do security teams know whether mining activity is legitimate or malicious?
• How do security teams know whether extension ecosystems are exposing credentials?
• How do security teams know if their Git automation is exposed to traversal risk?