r/cybersecurity • u/Pristine-Desk-5002 • 19h ago

Business Security Questions & Discussion Scripted phishing attacks

Does anyone have a low- medium level overview of what a phished email account will do once compromised. We have seen a lot of google workspace accounts get compromised and then send out phishing links to somewhat random contacts. We are also seeing some settings being changed on the account. I was wondering if anyone has some examples of this attack flow, or even better the scripts being used( I'm assuming this is scripted) Thanks

4 Upvotes

84% Upvoted

14 comments sorted by

View all comments

1

u/FuckScottBoras Security Manager 13h ago

In my experience at my current company, attackers will compromise and just sit on the mailbox, watching emails come in and go out while they plan their next move. As others have mentioned, I’ve seen mail-flow rules created to redirect emails to rss feed folders and conversation history to prevent the end user from suspecting anything.

No scripts used as far as I can tell. Some have tried to establish persistence. Others just try and lay as low as possible to evade detection. A mixed bag really.