What happens when attackers compromise a supplier account and use it to send email?

How a Compromised Supplier Account Becomes an Email Attack Path

When a supplier account is taken over, the attacker inherits trust already established between organisations. That lets them insert themselves into ongoing conversations, send messages that look routine, and exploit the recipient’s expectation that the sender is legitimate. The danger is not just impersonation, it is the misuse of a real business relationship to move money, request information, or push malicious content.

A compromised supplier mailbox is especially effective because the attacker can continue the conversation in context. They can reply inside an existing thread, mirror normal tone and timing, and exploit message history to lower suspicion. That makes the attack more persuasive than a cold phishing email and increases the chance that the recipient will act without challenge.

This kind of compromise also turns email into a delivery channel for broader fraud. A single trusted account can be used to alter invoice details, redirect payment instructions, request payroll or procurement changes, or deliver attachments and links that lead to further compromise. Because the communication path is authentic, the control failure often sits in the trust relationship rather than in obvious technical indicators.

Why These Attacks Are Hard to Spot

The main detection problem is that the message may be technically valid even when the intent is malicious. It comes from a genuine supplier domain or mailbox, may pass ordinary trust checks, and may be sent from normal infrastructure. That reduces the value of simple sender checks and makes behavioural anomalies, payment changes, and unusual request patterns more important than header analysis alone.

Attackers also rely on message timing and business routine. They often wait for active threads, seasonal payment cycles, or periods when approvals are rushed. By operating inside a relationship that already exists, they can exploit legitimate context to bypass the scepticism that usually stops unsolicited phishing.

What the Recipient Usually Experiences

For the recipient, the first visible sign is often not malware but a business process deviation. The email may ask for a bank detail change, a revised invoice, a document review, or a confidential file. If the recipient does not cross-check the request through a separate channel, the attack can proceed as an ordinary business transaction until the financial or data loss becomes visible.

In more advanced cases, the attacker uses the supplier account to spread laterally through trust chains. A compromised vendor can send convincing follow-up messages to customers, subsidiaries, or other partners, creating a wider fraud campaign from one account takeover. That is why the impact is often larger than one mailbox compromise would suggest.

Risk and Threat Considerations

Supplier-account compromise is risky because it weaponises an existing trust boundary. The attacker does not need to invent a convincing pretext from scratch, they only need to occupy a role that the recipient already expects to hear from. That makes payment diversion, credential harvesting, and malware delivery more likely to succeed, especially when business processes allow email-only approvals.

Failure mechanism: The attacker abuses a legitimate supplier identity to blend malicious requests into normal correspondence, then relies on weak out-of-band verification to complete fraud or data theft.

Impact: The likely outcomes are direct financial loss, exposure of sensitive business information, and wider compromise if the email is used to seed additional phishing or malicious attachments.

Practitioner Guidance

What to verify: Treat any supplier request that changes payment, banking, contact, or document-handling details as a high-risk event unless confirmed through an independent channel. The key judgement is not whether the email looks authentic, but whether the request is consistent with prior business process and verified outside the mailbox.

What good looks like: The organisation can prove that critical supplier changes are approved through a separate workflow, and that finance, procurement, and help desk staff know when to pause on-thread instructions. Where teams still rely on email alone, the fraud path is already open.

Practitioner takeaway: The real control is not detecting every compromised supplier inbox, it is removing email as the final authority for high-impact business changes.

Related resources from NHI Mgmt Group

• What happens when attackers use inbox rules after they compromise an email account?
• What happens when attackers use a compromised email account to move through connected SaaS apps?
• What happens when an email account is compromised and attackers use it to launch lateral phishing?
• What happens when attackers use a compromised vendor account to send phishing links?