What happens after attackers get access to a legitimate email account through phishing?

What happens after a phishing compromise turns a mailbox into a trusted foothold?

Once an attacker controls a legitimate inbox, the mailbox becomes both a source of intelligence and a launch point. They can quietly review conversation history, infer business processes, exploit existing trust relationships, and blend malicious replies into normal threads. In practice, the most damaging step is often not the initial login but the attacker’s ability to operate as the user without triggering suspicion.

A compromised mailbox also changes the attacker’s options beyond simple email theft. They can reset passwords for connected services, pivot into third-party applications that trust the account, and use the inbox to approve or redirect sensitive requests. That is why email compromise often develops into a broader account-takeover event rather than staying confined to messaging.

Time matters because each hour of undetected access increases the attacker’s visibility into contacts, payment workflows, and vendor patterns. The longer the compromise persists, the more likely it is to produce impersonation, invoice fraud, data exposure, or follow-on compromise of adjacent systems.

Why legitimate access is more dangerous than obvious spam

A phishing attacker does not need to break email security controls once the user has already done the hard part for them. With real credentials or a valid session, messages come from a trusted address, conversation threads provide context, and recipients are less likely to challenge unusual requests. That trust advantage is what turns a single mailbox compromise into a high-yield business email compromise path.

Attackers often exploit the mailbox as an intelligence source before they act. They look for payment terms, executive assistants, supplier names, recurring invoice patterns, and internal escalation habits. That context lets them craft convincing requests, time their messages to avoid scrutiny, and impersonate the victim in ways that are much harder to spot than generic phishing.

Connected applications expand the blast radius. If the mailbox is used for single sign-on, password reset, ticketing, document sharing, or SaaS notifications, the compromise can reach far beyond email itself. For the same reason, mailbox access should be treated as a privileged trust relationship, not just a communications problem.

How attackers usually turn inbox access into broader fraud or compromise

The common sequence is reconnaissance, impersonation, and monetization. First, the attacker reads mail to understand relationships and find useful approvals, then they send believable messages from the victim’s account or from lookalike threads. After that, they may alter payment instructions, request urgent wire transfers, or redirect vendors to new bank details. This is why phishing-led compromises often look like ordinary business activity until the financial loss is already underway.

They also search for recovery paths and service integrations. Mailbox rules, forwarding settings, app authorizations, and OAuth-consented tools can keep the attacker present even after the password changes. Where those connections exist, the compromise is no longer just a stolen login, it is a persistence problem.

More advanced actors use the mailbox as an entry point into third-party risk. If vendors, payroll providers, or shared collaboration tools trust messages from the account, the attacker can trigger actions outside the mailbox and make the incident operationally much larger than the original phishing lure.

Risk and Threat Considerations

A legitimate mailbox is valuable because it combines trust, continuity, and access to sensitive context. That makes it an ideal platform for stealthy fraud, internal reconnaissance, and secondary compromise, especially when the account is linked to payment workflows or external applications.

Failure mechanism: The attacker abuses a real identity to inherit existing trust, then uses thread history, reset links, forwarding rules, and connected-app permissions to extend control and persist after the initial phish.

Impact: The likely outcomes are business email compromise, vendor fraud, data exposure, credential resets, and wider operational loss if the mailbox is used to authorize or route sensitive business actions.

Practitioner Guidance

What to prioritise: Treat the incident as an account-takeover investigation, not a mailbox cleanup. The first question is whether the attacker retained access through forwarding, inbox rules, OAuth grants, or reset-capable sessions, because those are the paths most likely to sustain harm.

What to verify: Confirm whether the account has been used to send messages, approve transactions, or authenticate to downstream services. Also verify whether finance, procurement, or executive workflows rely on the mailbox for identity confirmation, since that determines the urgency of fraud containment.

Practitioner takeaway: The core risk is not that an attacker can read email, it is that they can borrow a trusted business identity long enough to make fraudulent actions look routine.

Related resources from NHI Mgmt Group

• What happens after attackers obtain access tokens through device code phishing?
• What happens when attackers gain access through the help desk instead of phishing email?
• What happens after an attacker gains access to a Microsoft 365 account through phishing?
• What happens after attackers steal credentials through a phishing page and gain initial access?