Security teams should assume the attacker has done prior research and may use highly tailored messages to bypass generic awareness training. The right response is layered detection, stronger identity verification for financial workflows, rapid account takeover response, and tighter controls around money movement. Treat email as one entry point, not the only one, and watch for delayed domain use and dormant infrastructure.
Why long running spear phishing campaigns need more than awareness training
Long running campaigns succeed because attackers iterate. They refine the story, time delivery around business cycles, and reuse trust signals that a one-time awareness module will not catch. The practical problem is not just message quality, but that a financially motivated campaign is usually designed to reach payment approval, account reset, or executive impersonation points where speed and trust pressure override caution.
That means the defensive question is not “can users spot phishing?” but “where can a false request still move money, reset access, or trigger a compensating action?” Security teams should treat the campaign as a control-gap problem across email, identity proofing, and payment workflow design, not as a pure inbox hygiene issue.
For broad campaign mapping and response discipline, use MITRE ATT&CK Enterprise Matrix to connect observed phishing activity to credential access, follow-on account use, and downstream intrusion steps.
Where the attacker wins: identity checks, payment approval, and account recovery
Financially motivated spear phishing often works by slipping into legitimate business processes. The target may receive a convincing invoice change, wire request, payroll update, benefits change, or vendor banking request. If the organisation relies on email alone, the attacker only needs one successful message to trigger a weak secondary process, such as a callback that uses the same compromised mailbox or a payment queue that does not enforce out-of-band verification.
Reduce impact by making the high-value workflow hard to complete from email alone. Payment changes, payee additions, credential resets, and executive exceptions should require a second trusted channel, explicit ownership checks, and documented approval paths that are independent of the mailbox being targeted. This is where phishing campaigns become expensive for attackers: even if email is compromised, the money movement path should still resist execution.
To harden verification for these workflows, NIST SP 800-63 Digital Identity Guidelines is useful for aligning assurance level and phishing-resistant authentication expectations with sensitive approvals.
The same principle applies to access recovery. If a phish leads to takeover of an employee mailbox or collaboration account, recovery procedures must not simply trust the compromised channel. Teams should ensure reset and recovery steps can be escalated quickly, because delayed containment often turns one mailbox compromise into a broader fraud event.
For access-control and authentication policy reinforcement, NIST SP 800-53 Rev 5 Security and Privacy Controls supports tighter account verification, least privilege, and auditability around sensitive transactions.
How to detect a campaign that stretches over weeks or months
Long running spear phishing is often more dangerous than a one-off burst because the attacker can wait for the right moment. The initial message may be low drama and only serve to establish rapport, collect responses, or identify the right approver. Later messages may reference prior correspondence, dormant vendor accounts, or internal projects that were surfaced through earlier reconnaissance.
Detection therefore needs to look for patterns, not just single messages. Teams should correlate impersonation attempts, lookalike domains, newly registered or recently active domains, unusual reply chains, mailbox forwarding changes, and attempts to move conversations away from normal procurement or finance channels. If the campaign is persistent, detection also needs to include business-side anomalies, such as a rushed payment request that matches a known vendor but arrives through an unusual path.
Email controls help, but the better signal is cross-channel correlation: suspicious mail plus unusual authentication events, odd approvals, and changes to vendor or payroll records. That combined view makes it harder for an attacker to rely on one successful phish and then quietly wait for a later payout opportunity.
For operational containment and incident coordination, FIRST incident response standards provide a useful reference point for coordinating triage, escalation, and fraud response across security and business teams.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | The subject is spear phishing campaigns and follow-on compromise paths. |
| Recommendation — Map phishing lures to T1566 and correlate them with downstream credential access and fraud activity. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Financial workflows need stronger identity verification than email trust alone. |
| Recommendation — Require an assurance level that matches the sensitivity of payment and recovery actions. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Campaigns often leverage compromised accounts and recovery paths, so credential control matters. |
| AC-6 — Least Privilege | Limiting approval and transaction authority reduces the blast radius of a successful phish. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Persistent campaigns are best caught by correlating suspicious mail, approvals, and account events. | |
| Recommendation — Tighten authenticator lifecycle controls for accounts that can approve or reset sensitive actions. Restrict who can approve, change, or release high-risk financial actions. Review linked email, identity, and payment logs for unusual approval chains and recovery events. | ||
Practitioner Guidance
What to prioritise: Focus first on the workflows where a phish can become a monetary loss, not on every inbox equally. If a request can change bank details, release funds, or reset a privileged account, it deserves stronger verification than ordinary email handling.
Decision rule: If the request originates in email but changes money movement or recovery state, require an independent verifier and a separate approval path. If the process cannot survive compromise of the mailbox, it is too fragile for a financially motivated campaign.
What to verify: Confirm that finance, payroll, and identity recovery teams can distinguish a legitimate exception from a callback engineered by the attacker. Test whether a rushed request still gets blocked when the sender address, display name, and tone look convincing.
What practitioners underestimate: The attacker does not need to win every message, only the one that lands at the right point in a slow business process. Long running campaigns are successful when defenders monitor messages but do not harden the business action that follows them.
Practitioner takeaway: The best reduction in impact comes from making email insufficient to authorise money or recovery, so a convincing phish cannot become a payment or takeover event on its own.
Related resources from NHI Mgmt Group
- How should security teams reduce the impact of GitHub phishing attacks against developer accounts?
- How should security teams reduce the impact of credential phishing when attackers keep changing targets so quickly?
- How should security teams defend against spear phishing campaigns that use spoofed business emails and malicious attachments?
- How should security teams defend against spear phishing campaigns that use government themes and shortened links to deliver malware?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
