What are the signs that email-delivered malware is already propagating internally?

How to tell internal propagation from a single inbox compromise

Once email malware starts moving laterally inside a tenant or domain, the pattern usually changes from one suspicious message to a repeatable internal campaign. The earliest clue is often not a payload alert but a shift in sender context: messages appear to come from trusted coworkers, shared contacts, or workflow-linked accounts that would not normally distribute the same file or link.

That distinction matters because internal propagation usually implies an attacker has already crossed a trust boundary. At that point, the problem is no longer just one malicious email arriving from outside. It is evidence that the campaign may be harvesting address books, abusing compromised mailboxes, or reusing conversation threads to make delivery look routine.

A useful way to read the signal is to compare normal business communication with the infected pattern. Internal-looking messages that arrive from the wrong account, at odd times, or with an attachment type that the sender rarely uses deserve immediate attention. So do messages that look similar across many recipients, because repetition is a common feature of automated spread rather than human correspondence.

CircleCI breach 2023 is a good example of how malware-driven session theft can turn one foothold into wider secret exposure, while Shai Hulud npm malware campaign shows how self-propagating activity can spread through trusted developer workflows once credentials or tokens are reused.

Behavioral signs that the campaign is already moving sideways

The strongest behavioral signs are volume, repetition, and sender-path anomalies. If you see a sudden cluster of near-identical messages, repeated delivery attempts after blocks or failures, or outbound mail generated by ordinary user accounts rather than a sanctioned system, treat it as propagation until proven otherwise. The campaign may also create new internal emails with familiar language copied from existing threads, which makes the messages harder to spot by content alone.

File behavior is another useful indicator. Unusual file types, archives that contain scripts, or attachments that prompt execution rather than simple viewing often appear when malware is trying to get a second foothold through user interaction. A message that feels like a normal internal handoff but arrives with a scriptable attachment, a renamed file, or an unexpected macro-enabled document is more suspicious than a generic phishing lure because it suggests the sender context has already been compromised.

Outbound patterns matter as much as inbox contents. Mail sent from user mailboxes to many internal recipients, especially when those recipients share no obvious business reason to receive the message, suggests the threat is using legitimate accounts as a distribution channel. That is often how defenders distinguish a single delivery event from a spreading campaign.

What to verify before assuming it is contained

Before declaring the event isolated, verify whether the suspicious mail originated from the expected workflow, whether the sender account recently authenticated from new devices or locations, and whether similar content was delivered to other internal recipients. Mail server logs, message trace results, and endpoint telemetry should be checked together, because each view can show a different part of the propagation path.

If the same sender account has created multiple delivery attempts or if multiple users received the same payload through different threads, the working assumption should shift to internal spread. CIS Controls v8 is useful here because the controls around audit logging, malware defence, and account management support the exact detection and containment decisions this pattern demands.

Where available, correlate the mail event with endpoint activity on the sender system and the first recipients. A compromised workstation can explain why a legitimate mailbox started sending malware, while a compromised mailbox can explain why trusted senders appear in the chain. Either way, the main question is whether the attacker has reused trust to keep the spread going.

Practitioner Guidance

What to prioritise: Treat sender-account compromise and repeated internal delivery as a single investigation. Contain the mailbox and the endpoint together when possible, because mail-only containment can miss the system that is still generating the next message.

What to verify: Confirm whether the same payload, hash, or link is appearing across multiple internal recipients, and whether any of the sends came from accounts that should never distribute files at all. That combination is often more actionable than the content of one message.

Common mistake: Teams often focus on the first suspicious inbox item and miss the outbound trail. If the compromised account is still sending, the incident is active propagation, not a single delivery event.

Practitioner takeaway: The decisive sign of internal spread is not merely that malware was received, but that trusted accounts or workflows are now acting as distribution paths.

Related resources from NHI Mgmt Group

• What makes Shai Hulud 2.0 different from a normal npm malware event?
• Why do weak passwords make email-delivered malware more dangerous?
• How should security teams defend against crypter-delivered malware in email campaigns?
• What are the signs that a stealthy malware campaign is already operating inside containerised infrastructure?