Threat Actors Leverage Compromised Email Accounts for Targeted Phishing Attacks

Cybercriminals are increasingly sophisticated in their phishing attacks, with threat actors now leveraging compromised email accounts from trusted sources to bypass security controls and enhance campaign legitimacy.

Recent incident response data reveals phishing remains a dominant attack vector, accounting for one-third of all security engagements in Q2 2025, despite declining from the previous quarter’s 50 percent rate.

The evolution demonstrates a strategic shift toward credential harvesting operations, with attackers prioritizing acquisition and brokerage of compromised credentials over traditional financial fraud schemes.

This approach offers cybercriminals a more reliable and scalable revenue model, as stolen credentials can be repeatedly monetized through underground markets without complexities associated with direct financial manipulation.

Cisco Talos analysts identified that 75 percent of phishing attacks now originate from compromised internal email accounts or trusted business partner communications systems.

This tactic effectively circumvents organizational security measures while exploiting inherent trust recipients place in familiar sender addresses, significantly increasing malicious campaign success rates.

The attackers’ methodology involves deploying malicious links redirecting victims to sophisticated credential harvesting pages, often mimicking legitimate Microsoft Office 365 authentication portals.

These fraudulent pages frequently incorporate multi-factor authentication prompts to capture both primary credentials and session tokens, enabling persistent access even when additional security measures are implemented.

Advanced Infection Mechanisms and Persistence Tactics

The infection mechanism demonstrates remarkable sophistication in exploiting organizational trust relationships.

In documented cases, attackers successfully compromise initial email accounts and utilize these legitimate credentials to distribute internal spear-phishing messages containing links to internal SharePoint resources.

These SharePoint links redirect victims to credential harvesting pages that successfully deceive multiple users within the same organization, creating cascading compromise effects that rapidly expand the attacker’s foothold.

To maintain persistence and evade detection, threat actors adopted legacy PowerShell versions, specifically PowerShell 1.0, which lacks modern security features including script block logging, transcription logging, and antimalware scan interface capabilities.

This deliberate use of outdated infrastructure allows attackers to operate with reduced visibility while maintaining flexibility necessary for complex multi-stage attacks.

Integrate ANY.RUN TI Lookup with your SIEM or SOAR To Analyses Advanced Threats -> Try 50 Free Trial Searches