What happens when an attacker gains full access to a user mailbox through email account compromise?

How mailbox takeover changes the attacker’s position

Once an attacker has full mailbox access, the mailbox stops being just a communications channel and becomes a live intelligence source. They can review prior conversations to understand how people write, who approves what, which vendors are trusted, and which topics are sensitive. That context makes later impersonation much harder to spot because the attacker can mirror the victim’s normal tone and timing.

The bigger shift is operational: the attacker can now act from inside an established relationship rather than from a spoofed address. That means they can reply inside existing threads, reference real projects, and exploit the trust already built between the account owner and recipients. The compromise therefore turns a single account event into a broader trust and workflow problem.

What an attacker can do with a compromised mailbox

With mailbox control, the attacker can harvest information, intercept replies, and redirect conversations without needing to break each target separately. They may capture passwords, reset links, invoices, contracts, or approval trails from message history, then use those artifacts to extend the intrusion into other systems. If the inbox is connected to shared calendars, file links, or ticketing systems, the attacker also gains clues about schedules, dependencies, and pending actions.

This is why mailbox compromise often supports fraud as well as espionage. A convincing “follow-up” message can request payment changes, redirect a sensitive attachment, or ask a colleague to approve a request that appears routine. The attacker is not inventing a new relationship, they are weaponising one that already exists.

Why mailbox compromise keeps spreading

Mailbox takeover is effective because email sits at the centre of account recovery, approval workflows, and informal business decision-making. Even if the initial compromise is limited to one user, the mailbox can expose enough context to compromise others through phishing, conversation hijacking, or password reset abuse. In practice, the mailbox becomes both a collection point and a launch point.

That makes speed important. The longer the attacker remains undetected, the more likely they are to expand from message access into credential theft, internal impersonation, and secondary compromise of cloud apps or business systems tied to the mailbox. The control failure is rarely just “someone read email”; it is that email often functions as a trusted bridge into many other identities and workflows.

Risk and Threat Considerations

Mailbox compromise is high impact because it combines visibility, impersonation, and downstream access in one place. The attacker can use the mailbox to observe relationships, manipulate approvals, and trigger additional compromise paths before the victim notices. The main danger is not only data exposure, but the attacker’s ability to operate as a trusted insider in ongoing conversations.

Failure mechanism: The attacker uses legitimate mailbox access to read context, reply within existing threads, and harvest recovery or approval material that can be reused against other accounts and systems.

Impact: Organisations can see fraud, sensitive data exposure, account recovery abuse, and lateral spread into adjacent services, often with a higher chance of successful social engineering because the attacker can mimic real correspondence.

Framework Alignment

Map mailbox compromise to MITRE ATT&CK Enterprise Matrix for credential access, persistence, and lateral movement patterns that commonly follow email account compromise.

Use NIST SP 800-53 Rev 5 Security and Privacy Controls to tighten authentication, logging, and account monitoring around inboxes that can trigger broader access.

Apply OWASP ASVS where mailbox compromise leads into password resets, session abuse, or weak account recovery flows in connected applications.

Reference CIS Controls v8 for practical account management, audit logging, and data protection safeguards that reduce the blast radius of a hijacked inbox.

Use NCSC UK Advice and Guidance for operational guidance on remote access, email security, and response patterns after compromise.

Related Resources

For real-world compromise patterns, see The 52 NHI Breaches Report, which includes theft, exploitation, and lateral movement case studies.

For adversary behaviour after initial access, review MITRE ATT&CK Enterprise Matrix alongside the mailbox compromise workflow to understand how attackers move from access to expansion.

Practitioner Guidance

What to prioritise: Treat mailbox compromise as both an account incident and a trust incident. The first questions are which threads, approvals, and recovery channels were exposed, and whether the mailbox had access to password reset paths, finance workflows, or privileged internal conversations.

What to verify: Check sign-in history, message forwarding rules, delegated access, OAuth app grants, and any unusual use of recovery emails or approval links. If the mailbox was used in active business threads, assume recipients may also need warning because the attacker can continue the conversation convincingly.

Practitioner takeaway: The most important judgment is to contain the account and the surrounding trust relationships together, because a compromised mailbox is dangerous precisely when other people still believe the voice behind it is authentic.

Related resources from NHI Mgmt Group

• What happens after an attacker gains access to a Microsoft 365 account through phishing?
• What happens when a compromised user account also has access to multiple apps and AWS resources through SSO?
• What happens when an attacker gains access through social engineering and is left undetected?
• What happens when an attacker resets a privileged account through a zero click email abuse flaw?