How account takeover and business email compromise quietly drain businesses while everyone watches for the ransom note.
Most cybersecurity content right now is about ransomware. Headlines, vendor blogs, board decks. It makes sense. Ransomware is dramatic and expensive, and it makes for a clear story.
It’s also not the only way attackers wreck your business.
Over the past month, our SOC partner at Cyberleaf worked several separate incidents involving account takeover (ATO) and business email compromise (BEC). No ransomware, or locked files. No skull on a screen. Just attackers quietly inside email accounts, reading invoices, redirecting wire transfers, and using one compromised inbox to phish the next.
If you’re only watching for ransomware, you’re missing the attacks that are hitting mid-market businesses every day.
Here’s what we’re seeing, why it works, and what to do about it.
The myth: “they just guessed the password”
In nearly all of the recent incidents we reviewed, attackers didn’t crack a password at all. They stole the authenticated session token after a user logged in legitimately.
It’s called an adversary-in-the-middle attack. The user clicks a phishing link, lands on a page that looks exactly like the real Microsoft or Google login, types in credentials, and completes MFA. The attacker’s infrastructure quietly relays everything to the real service, captures the session cookie, and walks in as the user. No password to change. No alert to trip. The session is just live.
This is why “we have MFA, we’re fine” is dangerous. MFA still matters, and we’ll come back to that. But MFA doesn’t stop a stolen session.
What attackers do once they’re in
The motive isn’t always the same. Across recent incidents, we’ve seen three patterns.
- Smash and grab. They rifle the mailbox for anything monetizable. Invoices, contracts, signed proposals. They download what looks valuable and leave. Sometimes weeks later, the customer gets an extortion email threatening to publish proprietary information online.
- Mass phishing from a trusted account. They blast every contact in the address book with a phishing email. It works because the email is genuinely coming from someone the recipients know and trust. We’ve seen 1,500-email blasts in a single hour. Loud, but effective.
- True BEC: thread hijacking. This is the cleverest one and the most expensive. The attacker doesn’t start a new conversation. They find an existing email thread about an invoice or contract, wait for the right moment, and reply mid-conversation with updated wire instructions. The finance team trusts replies more than new emails because they’re part of an ongoing thread. The money goes to the attacker’s account. By the time anyone notices, it’s gone.
The mechanics: how one compromise becomes four
One incident we worked started as a single compromised account at a regional logistics customer. By the time the investigation finished, it was four compromised accounts at the same company, connected by shared attacker infrastructure.
Here’s how it moved.
The first user got phished, an executive who handled outside communications. The attackers logged in as them, then set up inbox rules to auto-delete external emails from a specific sender. That sender was the actual phishing victim’s contact, the one who had originally been compromised and used to phish this user. Translation: the attackers covered their tracks so if anyone caught on and tried to warn the victim, the warning email would disappear before being seen.
Then they used that first account to phish two coworkers. Same playbook on each compromised account: inbox rules to hide any follow-up emails from the first victim, in case they realized they’d been phished and tried to warn the team.
How did we know all four were connected? Shared infrastructure. The same attacker IP address appeared across all of them as part of the token theft step. To the customer, it looked like four unrelated incidents. To us, it looked like one operation moving laterally through a single business.
This is commoditized work now. There are entire server fleets set up to relay these attacks at scale.
Why your users keep getting fooled
You can run all the phishing training in the world and still lose to a well-crafted BEC. Here’s why.
Attackers don’t need to fool everyone, they only need to fool one person who handles invoices, contracts, or proposals as their job. You can’t tell a billing clerk to “stop opening PDFs.” Opening PDFs is the job.
So the goal isn’t suspicion of every link, it’s understanding internal workflows well enough to spot when something’s directionally wrong.
The most important word in that sentence is directionally.
The directionality principle
Here’s the test that catches almost every BEC attempt: Which direction does this thing normally flow?
You sign into your company’s systems. Customers and partners sign into theirs. Contracts go out from your business to clients, then come back signed. Invoices follow a known internal review path.
When an external email asks you to put your work credentials into someone else’s portal, that’s directionally wrong. It doesn’t matter how legitimate the DocuSign branding looks or how convincing the email is. You don’t sign into other people’s systems with your work account.
Same goes for thread hijacks. If a long-running invoice conversation suddenly changes the bank routing number, that’s directionally wrong. Real vendors don’t change banks mid-thread. Pick up the phone, call a number you already have on file, and verify by another channel.
Attackers exploit a habit we’ve built in our personal lives, using Google or Facebook sign-ins for everything because it’s convenient. That muscle memory is the target. SSO works inside your business. It shouldn’t work to log into someone else’s invoicing portal.
MFA and security awareness training are still table stakes
A note before going further: MFA and security training are not the problem. Without MFA, this would be a bloodbath; every one of these attacks would succeed automatically. And without security awareness training, your employees will lose vigilance and quit reporting suspicious digital behaviors.
MFA is the reason attackers have to work this hard. They need to phish a real person, build convincing infrastructure, and time the attack carefully. Without it, none of that would be necessary.
Use authenticator apps over SMS where possible. Hardware keys where the risk warrants it. But the headline is: MFA is non-negotiable, and it’s working.
Similarly, be vigilant about training your staff in what to look for, how to report it, and how to think about directionality. Every single person in your organization plays a role in protecting systems, data, and the company. Be sure you’ve communicated this information clearly and often and make it ok to report when something goes wrong, even if it’s after the link got clicked. It has to be safe to tell your security team as soon as someone realizes they made a mistake.
What good response looks like
When something does get through, the response window is brutally short. Here’s a lesson we’ve taken from recent incidents.
There’s a difference between disabling an account and evicting an attacker. Disabling stops new logins but it doesn’t kill the active session the attacker already has. To truly evict them, you need three steps in this order:
- Revoke active sessions
- Reset the password
- Revoke sessions again
That second revoke matters. It catches any residual device connections the first pass missed. Skip steps or pause between them, and you’ve created a window for the attacker to dig in further.
What a good security partnership covers
Stopping ATO and BEC isn’t a one-control problem, it takes layers.
- Email hardening. SPF, DMARC, and DKIM properly configured. Sender reputation tuned. The garbage gets filtered before it ever reaches an inbox, so users only deal with the genuinely tricky stuff.
- MFA, everywhere, with strong factors. Authenticator apps minimum. Phishing-resistant factors for high-risk roles.
- 24/7/365 SOC monitoring for what humans miss. Token theft, anomalous logins, inbox rule creation, session anomalies. By the time your users notice, the attacker has already done damage.
- Workflow literacy in your team. Training that covers how your business actually moves money, signs contracts, and shares files. So when something or someone asks for an action outside that flow, alarms go off.
- Information sharing. Not generic cartoony “spot the phish” videos. Real, recent threat intel from your security partner about what’s hitting businesses like yours right now.
The takeaway
Ransomware gets the headlines. Account takeover and BEC are quieter, faster to monetize, and often the attack of choice against mid-market businesses. They cost real money and they don’t trigger the kind of alarms a locked screen does.
Good defense is layered and unglamorous. Email hardening, strong MFA, a SOC watching for the indicators, and a team that knows their own workflows well enough to spot what doesn’t fit.
If you’re not sure where your gaps are, that’s the right place to start a conversation.
