InMail

How InMail works

InMail is a direct-messaging capability, so the core security issue is not the feature itself but the trust it creates between sender profile and recipient. Because the message can arrive outside normal email routing and inbox controls, users may treat it as a legitimate outreach channel even when the sender is unknown.

That design matters in abuse cases. Attackers can use profile-based messaging to reach targets without needing an address book entry or shared mailbox access, which reduces friction and can make initial contact feel more personal than bulk spam.

Why InMail is attractive to attackers

InMail is useful for social engineering because it can bypass some of the friction and filtering that users associate with email. A message delivered through a platform profile can feel narrower, more targeted, and more credible than a generic campaign, especially when the attacker imitates recruiters, sales contacts, or internal stakeholders.

The main danger is trust transference: recipients may evaluate the sender’s profile, company name, or mutual connections instead of verifying the actual request. That makes the channel effective for credential harvesting, malware lures, and fraudulent payment or account requests.

Common abuse patterns and failure modes

Typical abuse starts with profile reconnaissance, followed by a persuasive first message and a request to move the conversation to another channel. Once the victim is engaged, the attacker may ask for a login, a file, a meeting link, or a one-time code, using urgency or exclusivity to suppress scrutiny.

Failures usually happen when organisations rely on user intuition alone. If recipients are not trained to verify requests, and if downstream controls do not challenge risky links, attachments, or credential submissions, InMail becomes a low-friction entry point into broader compromise.

Controls that reduce the risk are strongest when they combine user awareness with platform monitoring and identity protections. NIST SP 800-53 Rev 5 Security and Privacy Controls provides a useful control catalogue for access control, authentication, logging, and configuration discipline, while NIST Cybersecurity Framework 2.0 helps teams organise governance, detection, and response around the channel rather than only around email.

How organisations should respond to suspicious InMail

Security teams should treat suspicious messages as a cross-channel phishing problem, not as a narrow messaging issue. The practical response is to preserve the message, verify the sender through an independent path, and assess whether the conversation attempted to move the target toward credential entry, payment fraud, or malicious file delivery.

Where platform abuse is part of a wider social-engineering pattern, threat intelligence and hunting content can help validate the broader intrusion path. MITRE ATT&CK Enterprise Matrix is useful for mapping the follow-on behaviours often seen after initial contact, while OWASP API Security Top 10 is helpful when the campaign pivots into token abuse, account abuse, or automated interaction with exposed services.

Risk and Threat Considerations

InMail creates a material phishing and impersonation risk because it shifts trust from the mail gateway to the sender profile. That can lower user suspicion, increase reply rates, and give attackers a direct path to credential theft, payment fraud, or malware delivery.

Failure mechanism: The attacker abuses platform trust signals, such as profile legitimacy, mutual connections, or professional context, to bypass normal recipient caution and initiate a malicious conversation.

Impact: A successful exchange can expose credentials, tokens, business-sensitive information, or access to downstream accounts and systems if the recipient follows the attacker’s instructions.

Practitioner Guidance

What to watch for: Treat unsolicited InMail that requests urgent action, off-platform contact, file sharing, login verification, or payment steps as a high-risk social-engineering event. Security teams should ensure users know that sender profile credibility is not a reliable trust control.

Governance implication: Define how suspicious platform messages are reported, triaged, and correlated with broader phishing monitoring so that abuse on a social platform is handled with the same discipline as email-based attack traffic.