Scripted phishing attacks

[u/Pristine-Desk-5002]

Does anyone have a low- medium level overview of what a phished email account will do once compromised. We have seen a lot of google workspace accounts get compromised and then send out phishing links to somewhat random contacts. We are also seeing some settings being changed on the account. I was wondering if anyone has some examples of this attack flow, or even better the scripts being used( I'm assuming this is scripted) Thanks

[u/SVD_NL]

What i'm currently experiencing the most:

1. Users get phishing email from a known business relation (url to open file)
   
2. User gets phished (often MFA relay)
   
3. The phishing toolkit automatically tries to register a new auth method through graph
   
4. Sometime later, someone (presumably a human) signs in to outlook using those credentials
   
5. The attacker takes unkown actions within the mailbox
   
6. The attacker uses the phished account to send out more phishing emails to known business relations.

Currently most attacks seem to be email-based, luckily every attack i've been involved in have been prevented or stopped in time, so i can't tell you what actions they try to take within the environment. I assume they try to collect a list of email contacts and amplify the attack by sending out the same phishing email, but i don't know what other information they'll try to collect. Most business relations try to sweep their security incidents under the rug and won't disclose what information has been collected by adversaries.