Internal Phishing: What to Do When Malicious Emails Come from a Colleague

It is a nightmare scenario for any CISO or IT security leader. One morning, dozens of employees receive a message featuring an urgent login link or a critical attachment. The sender address contains no typos, the domain matches the organisation precisely, and SPF, DKIM, and DMARC checks all pass without a hitch. The reason is simple: the attack is not originating from outside the organisation, but directly from the legitimate mailbox of a colleague whose credentials have been compromised.

When an adversary breaches a Microsoft 365 or Google Workspace environment, immediate data exfiltration is not always the primary objective. Instead, their first instinct is often to execute lateral movement, exploiting the implicit trust granted to internal corporate communications. Against this method of attack, traditional perimeter defences fall short. Detection relies almost entirely on human vigilance and the rapid execution of structured incident responses.

How should employees react when a suspicious email arrives from a legitimate colleague?#

In brief: Never click reply to verify an email's authenticity. Contact the supposed sender immediately via an independent, out-of-band channel (such as a direct phone call or walk over to their desk) and report the email instantly to the IT security operations team to isolate the compromised account.

The instinctive reaction of many employees is simply to click "Reply" and ask: "Did you mean to send this to me?". This is a critical mistake. If an attacker controls the mailbox, they have full visibility over incoming traffic and will readily confirm the legitimacy of the request, often within seconds, to neutralise suspicion. In many cases, threat actors also implement hidden forwarding or deletion rules to suppress these queries entirely.

To disrupt the attack chain, staff must execute two immediate actions:

• Out-of-band verification: Reach out to the sender via an entirely separate channel. Call their direct corporate mobile number or speak to them in person if you share the same office floor.
• Immediate escalation to the security team: Use the dedicated phishing report button in your email client or forward the email as an attachment (.eml or .msg format) to the SOC or IT security team, ensuring the underlying technical headers remain fully intact for forensic review.

What indicators betray an internal account takeover despite a valid email address?#

In brief: Detecting compromised internal accounts relies on behavioural analysis: sudden shifts in linguistic tone, uncharacteristic urgency, unexpected requests to view shared documents, or generic messages injected awkwardly into existing email threads.

Internal account hijacking thrives on misplaced trust, but adversaries almost always leave subtle behavioural discrepancies. An attacker operating through a stolen session rarely understands the victim's nuances, internal culture, or unique writing style.

Key warning signs include:

• Shifts in tone and vocabulary: A colleague who normally communicates casually might suddenly use formal sign-offs, unnatural phrasing, or stilted English uncharacteristic of their usual correspondence.
• Artificial urgency and psychological pressure: The email might cite an overdue invoice, an impending system access suspension, or an urgent non-disclosure agreement that must be signed within the hour.
• Anomalous credential harvesting prompts: Embedded links lead to external login portals asking users to re-enter their domain credentials to view a routine SharePoint, OneDrive, or Google Drive file.
• Thread hijacking: The attacker inserts a malicious payload into an existing email thread that has been dormant for weeks or months, often providing a generic reply that does not quite match the preceding context.

Why does internal phishing facilitate rapid lateral movement?#

Account-to-account phishing serves as one of the most destructive escalation pathways within an enterprise. Once an initial account falls (frequently via session cookie theft following an adversary-in-the-middle attack), the attacker gains direct access to the global address list (GAL).

From there, the threat actor maps high-value targets across the organisation: finance teams, human resources personnel, and IT administrators. Within minutes, highly tailored lures land in the inboxes of privileged users. Because the messages originate from the internal network, recipients naturally let their guard down compared to interactions with external contacts.

To counter this threat effectively, organisations must move beyond passive, classroom-style compliance training. Hands-on exposure to lifelike attack simulations is essential. With our Super Phisher simulation platform, deployed alongside our dedicated team, you can expose your workforce to authentic social engineering tactics, replicating the mechanics of account takeovers and lateral hops to build resilience before a real incident occurs.

BRAIN SECURITY PRODUCT IN ACTION · Super Phisher

What emergency protocol must IT and security teams trigger upon alert?#

The moment an internal phishing incident is confirmed, every second matters to contain the blast radius and protect the wider infrastructure:

• Immediate session revocation: The IT team must immediately reset the compromised account's password and terminate all active sessions and authentication tokens across all registered devices.
• Inbox rule audits: Adversaries routinely configure hidden inbox rules to obscure their presence (such as auto-forwarding external copies or routing incoming emails containing words like "phishing", "security", or "password" directly to the RSS or Deleted Items folder). These rules must be audited and eradicated.
• Tenant-wide message purging: Using compliance search and remediation features within Microsoft 365 or Google Workspace, administrators must identify and purge the malicious email from every internal recipient's mailbox before further users interact with it.
• Authentication log analysis: Reviewing IP addresses, sign-in logs, and user agent strings helps security analysts pinpoint the exact moment of initial compromise and assess whether sensitive data was viewed or downloaded.

Defending your organisation against internal lateral movement requires seamless collaboration between technical controls and user awareness. To build a targeted cyber training programme aligned with your operational risks, book a demo with our specialists and discuss your requirements directly with the Brain Security team.

Further reading: related articles and Brain Security solutions#

Related articles on this topic

• Hybrid Work, Trains, Hotels: 6 Mobile Cybersecurity Mistakes That Expose Your Firm (Phishing & Social Engineering) : Discover vital mobile cybersecurity habits: public Wi-Fi risks, shoulder surfing, and enterprise VPNs to protect your remote and travelling workforce.
• Infostealers: Why Saving Corporate Passwords in Unmanaged Browsers Puts Organisations at Risk (Phishing & Social Engineering) : Learn how infostealers harvest corporate credentials and session cookies from unmanaged web browsers to bypass MFA and breach enterprise networks.
• Scareware and Fake Browser Alerts: Teaching Staff to Spot Web Traps (Phishing & Social Engineering) : Defend against scareware and fake virus alerts. Discover ClickFix tactics and help employees secure their web browsers against modern social engineering.
• Law Firms and Consultancies: Defending Client Confidentiality Against Targeted Cyber Attacks (Sectors & Roles) : Discover why law and consultancy firms face spear-phishing attacks and how to protect legal professional privilege with targeted security training.

Explore Brain Security solutions on our website

• Featured solution : Super Phisher : The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.
• Browse use cases by security goal and sector
• Compare our cybersecurity and AI awareness formats
• Explore the full interactive Brain Security catalogue
• Discuss your needs with our team (demo and setup)