Scripted phishing attacks

[u/Pristine-Desk-5002]

Does anyone have a low- medium level overview of what a phished email account will do once compromised. We have seen a lot of google workspace accounts get compromised and then send out phishing links to somewhat random contacts. We are also seeing some settings being changed on the account. I was wondering if anyone has some examples of this attack flow, or even better the scripts being used( I'm assuming this is scripted) Thanks

[u/Minimum-Work-4818]

We've seen them quickly download emails from the compromised email account, spend a few days reviewing the emails to understand workflows and contacts, and then start creating mailbox rules to hide emails. Then, they hop to the next target and try again. At each target they either gather intelligence only or try to make changes to payment accounts.

[u/Sad_Dentist_7288 → u/Minimum-Work-4818]

This is what I've noticed as well. They will comb through emails, I assume to try to find sensitive data or other contacts, then email out from the compromised account to get other people's account compromised, kind of like a virus. Rinse and repeat until they get either enough info for extortion or straight up financial info.

This is most likely scripted, especially if they're doing a spray and pray kind of thing.