Infographic

8 steps of Account Takeover attacks: Infographic

Eight stages, from picking your company off the internet to deleting the evidence on the way out. By the time a colleague notices anything odd, the attacker is on stage six.

Download the infographic

Infographic

About this infographic

Account takeover is not a moment, it is a campaign. Nothing is broken and nothing is encrypted — the attacker signs in with a working password and then behaves like the person who owns the mailbox.

This infographic walks the whole attack, stage by stage, and shows how much of it happens quietly inside an inbox that looks entirely normal from the outside.

Figures from the FBI Internet Crime Report 2019, Abnormal Security’s Q1 2020 BEC report, Juniper Research and IDC.

Inside

01Target acquisition — online research, supply chain analysis and WHOIS data to work out who is who and what your email addresses look like

02Account harvesting — building a list of named people, usually senior executives, finance teams or privileged users

03Gaining access — phishing, cracking, brute force, breach data or social engineering, with entry typically through Outlook Web Access

04Organisational recon — reading the inbox and sent items to learn the chain of command, who signs off payments, and how people write

05Mailbox re-configuration — innocuous-looking folders and keyword rules that quietly divert the conversations the attacker wants

06Conversation hijacking — posing as the account owner, slipping into threads with colleagues and suppliers, inserting false invoices

07Data exfiltration — email history and attachments first, then onward into OneDrive and SharePoint, and on to your suppliers and customers

08Clean up — messages deleted, rules and folders removed, a back door left behind for next time

One platform.
Four layers of control.

Tired of logging into lots of different tools that don't talk to each other? TrustLayer Platform gives you mail, web, user and SaaS security that actually works together. No patchwork, no platform fatigue.

Prefer the live
version?

Thirty minutes with an engineer beats any PDF. Your estate, not a slide deck.

Book a demo

Live platform, your questions.

Book a demo

Already with BT, an MSP or a reseller?

It can be switched on through them.

How →

8 steps of Account Takeover attacks: Infographic

One platform.Four layers of control.

Prefer the liveversion?

One platform.
Four layers of control.

Prefer the live
version?