Key findings:

Email account takeover and lateral phishing present a growing threat to enterprise organizations. One in seven organizations experienced lateral phishing attacks within a seven-month timespan, based on a random sample of enterprise organizations. Of the organizations who suffered from this attack, over 60% experienced multiple incidents.
Because email account takeover takes advantage of compromised, but nonetheless legitimate, enterprise accounts, these attacks are effective and particularly insidious. Over 11% of attacks successfully compromised additional employee accounts, and over 42% of the lateral phishing incidents appear to go unreported by a recipient to the organization's IT or security team.
Over 55% of the attacks in the study target recipients with some personal or work relationship to the hijacked account.
Lateral phishing attacks rely on two popular narratives to trick their victims into falling for the attack: "account error" and "shared document" lures. While 63% of the lateral phishing incidents used generic and commonplace messages, 37% tailored content to be more enterprise-oriented or highly specific to the victim organization.
Nearly all the lateral phishing attacks occurred during the regular workweek and during the victims' regular working hours, even though the attackers perpetrating the email account takeover might be remote or foreign actors.
Roughly one-third of email account takeover attacks in the study engaged in additional behavior designed to make their lateral phishing emails stealthier or more convincing, such as actively responding to recipients' questions or actively deleting all traces of the phishing email from the hijacked account.

Across the study's dataset, attackers used a total of 154 hijacked enterprise accounts to launch lateral phishing attacks. Researchers identified four primary strategies attackers used to select the potential victims:

Instant Insights /

New Research: Organizational Email Account Takeovers Push Lateral Phishing

Related Stories

Recommended For You