What should organisations do when phishing campaigns target employees through both external email and compromised internal accounts?

Why mixed-channel phishing changes the trust model

When phishing arrives through both external email and compromised internal accounts, the organisation is no longer dealing with a single inbound filter problem. The attacker is using two trust paths at once: one to get initial access, and one to make malicious requests look legitimate once inside the mailbox ecosystem. That means the defensive model has to treat internal mail as a potentially hostile delivery path, not a guaranteed trusted channel.

In practice, the highest-value targets are often the requests that blend into normal business flow, such as payment changes, credential resets, file-share invitations, or “urgent” approval requests. The risk is not just malware delivery. It is fraud, business email compromise, and account abuse that can continue even when perimeter filters catch obvious spam.

Controls that matter across both external and internal email

Defence needs to cover the full message path, from arrival to lateral movement. That includes inbound filtering, impersonation detection, mailbox anomaly detection, restrictions on auto-forwarding and suspicious delegation, and controls that reduce the value of a stolen account if it is reused to send trusted-looking messages. Strong authentication for users helps, but it does not solve the problem on its own because a compromised account can still send convincing mail from inside the tenant.

Organisations should also harden the processes that phishing tries to subvert. If an email asks for a payment, password reset, banking detail change, or document approval, the verification step should happen out of band through a known contact path or approved workflow. This is where controls such as phishing-resistant authentication, sender verification, and mailbox abuse monitoring reinforce each other rather than acting as separate silos. For identity assurance, NIST SP 800-63 Digital Identity Guidelines is useful when you are deciding how much trust to place in the login event itself.

Internal account compromise also changes the detection problem. A message from a legitimate internal mailbox may still be malicious, so security teams need rules that look for unusual senders, new forwarding rules, impossible travel, abnormal reply chains, and mass-mail behaviour. For a control framework view of those basics, NIST Cybersecurity Framework 2.0 provides the governance, protect, detect, respond, and recover lens that maps well to mailbox abuse.

How compromised internal accounts widen the attack path

Once an attacker has a working internal account, they gain more than delivery capability. They can observe internal language, mimic real workflows, harvest trust relationships, and reuse the account to attack colleagues, suppliers, and finance processes. That is why compromised-account phishing is often more dangerous than ordinary spam: the attack is no longer filtered by sender reputation alone, and the attacker can exploit the recipient’s expectation that internal mail is safe.

The practical consequence is that mailbox compromise must be treated as both an access issue and a fraud issue. If the attacker can use the account to reset other credentials, approve transactions, or request sensitive files, the blast radius can extend far beyond the email system. Organisations should assume that one compromised account can become a launching point for broader credential theft, impersonation, and lateral social engineering. The more tightly these accounts are governed, the less useful they are to an attacker.

Risk and Threat Considerations

Mixed-channel phishing raises the chance that users will trust a message for the wrong reason. External mail can be blocked, but a message sent from a compromised internal account can bypass normal suspicion and trigger quick action before verification happens.

Failure mechanism: The attacker combines inbound phishing with trusted internal delivery, then uses the compromised mailbox to maintain legitimacy, redirect conversations, or trigger approvals and credential resets.

Impact: Organisations can see credential theft, fraudulent payments, data exposure, and broader account takeover that spreads through trusted internal communication paths.

Practitioner Guidance

What to prioritise: Treat mail flow, mailbox compromise, and business-process abuse as one problem. If the message can influence finance, HR, executive, or admin workflows, it needs stronger verification than ordinary user mail.

What to verify: Check whether internal senders are being monitored for unusual forwarding rules, delegated access, abnormal sending patterns, and sudden changes in conversation behaviour. If those signals are missing, the attacker may be operating inside a trusted mailbox without being seen.

Decision rule: If an email request creates a real-world consequence, such as a payment, account change, or data release, require an independent confirmation path before action. If the request originated from a compromised internal account, treat the trust downgrade as immediate, not conditional on full forensic confirmation.

Practitioner takeaway: The key shift is to stop treating “internal” as synonymous with “safe”; once account compromise is plausible, the organisation must verify requests by process, not by sender location.

Related resources from NHI Mgmt Group

• How should organisations handle compromised government or law enforcement email accounts?
• How should organisations share sensitive files securely with external recipients without exposing data through email or messaging apps?
• What happens when attackers use compromised email accounts and university identities to target recruitment teams?
• How should organisations respond when attackers use an internal request system to gain more access through a compromised user?