Sponsored Kaseya feature: account takeover and outbound phishing, and INKY with SaaS Alerts as the defence
A sponsored feature from Kaseya, published on The Register, describes how account takeover (ATO) has become stealthier. Attackers obtain credentials, usually through GenAI-assisted phishing, then stay quiet and monitor email traffic until they can inject themselves into a conversation. A compromised mailbox is then used for outbound phishing against employees, internal payroll and invoicing systems, customers and suppliers. Impersonating senior staff is especially damaging because filters often let such senders through with little friction. The article is mainly a promotion of INKY and Kaseya SaaS Alerts and reports no specific incident, vulnerability or IOC.
Detalhes técnicos
- Typical ATO lifecycle: credential theft via phishing, a quiet period to test and verify the credentials, observation of mail threads, then weaponisation of the mailbox for internal and outbound phishing.
- Third-party ATO is hard to detect because the recipient cannot verify the sender organisation's authentication controls, such as MFA.
- A compromised identity can also give access to connected SaaS apps, cloud storage and collaboration tools, widening the blast radius.
- INKY uses sender profiling, stylometry and machine learning to flag deviations from a trusted sender's known behaviour and writing style, even when headers look legitimate.
- When INKY detects a hijacked mailbox, it isolates the user and blocks outbound mail. It then sends an event to SaaS Alerts, which locks down that user's access across the rest of the stack.
Remediação
- Use behavioural and language-aware email analysis, including sender profiling, to catch conversation hijacking and third-party ATO.
- Respond to a confirmed takeover by isolating the user, blocking outbound mail and revoking access across SaaS applications, not only the mailbox.
- Integrate security tooling so detections trigger automated cross-application containment.
- Do not exempt senior staff from scrutiny, and encourage employees to report suspicious requests that appear to come from executives.
Linha do tempo
-
Sponsored Kaseya feature: account takeover and outbound phishing, and INKY with SaaS Alerts as the defence
ler a análise desta fonte ocultar
A sponsored feature from Kaseya, published on The Register, describes how account takeover (ATO) has become stealthier. Attackers obtain credentials, usually through GenAI-assisted phishing, then stay quiet and monitor email traffic until they can inject themselves into a conversation. A compromised mailbox is then used for outbound phishing against employees, internal payroll and invoicing systems, customers and suppliers. Impersonating senior staff is especially damaging because filters often let such senders through with little friction. The article is mainly a promotion of INKY and Kaseya SaaS Alerts and reports no specific incident, vulnerability or IOC.
Technical Details
- Typical ATO lifecycle: credential theft via phishing, a quiet period to test and verify the credentials, observation of mail threads, then weaponisation of the mailbox for internal and outbound phishing.
- Third-party ATO is hard to detect because the recipient cannot verify the sender organisation's authentication controls, such as MFA.
- A compromised identity can also give access to connected SaaS apps, cloud storage and collaboration tools, widening the blast radius.
- INKY uses sender profiling, stylometry and machine learning to flag deviations from a trusted sender's known behaviour and writing style, even when headers look legitimate.
- When INKY detects a hijacked mailbox, it isolates the user and blocks outbound mail. It then sends an event to SaaS Alerts, which locks down that user's access across the rest of the stack.
Remediation
- Use behavioural and language-aware email analysis, including sender profiling, to catch conversation hijacking and third-party ATO.
- Respond to a confirmed takeover by isolating the user, blocking outbound mail and revoking access across SaaS applications, not only the mailbox.
- Integrate security tooling so detections trigger automated cross-application containment.
- Do not exempt senior staff from scrutiny, and encourage employees to report suspicious requests that appear to come from executives.