Lateral Phishing: When Phishing Emails Come From Inside Your Organisation

Employees are trained to be suspicious of emails from unknown senders. They look for misspelled domains, unfamiliar names, and requests that seem out of place. But what happens when the phishing email comes from a colleague they know and trust, sent from that colleague's genuine, verified email address? This is lateral phishing, and it is one of the most difficult phishing threats for organisations to detect and defend against.

flowchart LR
    A["Compromised Account"] --> B["Phish Internal Contacts"]
    B --> C["Trusted Sender"]
    C --> D["Victim Opens Email"]
    D --> E["Second Account Compromised"]
    E --> F["Lateral Spread"]
  

Lateral phishing occurs when an attacker compromises one employee's email account and then uses that account to send phishing emails to other people within the same organisation. Because the emails originate from a real internal address, they bypass nearly every technical and human defence that organisations rely on. Understanding this threat is critical for any business that depends on email communication, which is to say, every business.

What Makes Lateral Phishing Different

Traditional phishing attacks come from external sources. Attackers spoof domains, register look-alike addresses, or send messages from compromised external accounts. Organisations have built extensive defences against this external threat: email authentication protocols like DMARC, SPF, and DKIM verify sender identity, secure email gateways flag messages from suspicious domains, and employees are trained to scrutinise emails from unfamiliar senders.

Lateral phishing inverts this model entirely. The phishing email is sent from a legitimate internal account that passes every authentication check. The sender's domain is correct. The display name matches a real colleague. The email address is one the recipient has exchanged messages with before. If the attacker has access to the compromised account's inbox, they can even reply to existing email threads, making the phishing attempt virtually indistinguishable from normal business communication.

This is what makes lateral phishing so effective and so dangerous. It exploits the implicit trust that employees place in internal communications. When an email comes from a known colleague, the psychological barriers that would normally trigger suspicion are dramatically lowered. The recipient is far more likely to click a link, open an attachment, or comply with a request because the source appears to be someone they work with every day.

How Attackers Gain Initial Access

Before lateral phishing can occur, an attacker must first compromise at least one email account within the organisation. Understanding the common methods of initial compromise is essential for preventing the chain reaction that lateral phishing creates.

Credential Theft Through External Phishing

The most common entry point is a traditional phishing attack that targets an employee from outside the organisation. The employee clicks a link in an external phishing email, enters their credentials on a fake login page, and the attacker captures those credentials. If the account is not protected by multi-factor authentication, the attacker can immediately log in and begin sending lateral phishing emails to the victim's colleagues.

Password Reuse and Credential Stuffing

Employees who reuse passwords across personal and professional accounts create a significant risk. When a personal account is compromised in a data breach, attackers can use those credentials to access the employee's work email. Automated credential-stuffing tools test millions of stolen username-password combinations against corporate login portals, and even a small number of matches can provide the foothold needed for a lateral phishing campaign.

Compromised Third-Party Applications

As discussed in the context of consent phishing, insider threats can also arise from compromised third-party applications that have been granted access to an employee's email account. If a malicious application has "send as" permissions, it can send emails from the employee's account without the employee's knowledge or involvement.

Session Hijacking and Token Theft

Attackers can steal active session tokens through malware, adversary-in-the-middle attacks, or browser exploits. With a valid session token, the attacker can access the victim's email account without needing their password or passing through multi-factor authentication. This method is particularly difficult to detect because the session appears legitimate to the email platform.

The Chain Reaction of Compromised Accounts

What makes lateral phishing particularly devastating is its capacity for exponential growth. A single compromised account can be used to compromise multiple additional accounts, each of which can then be used to target even more colleagues. This creates a cascading effect that can rapidly engulf an entire organisation.

Consider a scenario where an attacker compromises the account of a mid-level manager. That manager has regular email contact with their direct reports, their peers in other departments, and their own supervisor. The attacker sends a convincing phishing email to all of these contacts, perhaps sharing a link to what appears to be a shared document or a meeting agenda. Because the email comes from someone they know and trust, a significant percentage of recipients will click the link.

Each new compromise gives the attacker access to a fresh set of contacts and a fresh set of existing email threads to exploit. Within hours, the attacker can move from a single compromised account to dozens, gaining access to email inboxes across multiple departments and seniority levels. The attacker can then use this widespread access for data theft, business email compromise, ransomware deployment, or financial fraud.

The speed of this escalation often outpaces the organisation's ability to detect and respond. By the time the security team identifies the first compromised account, the attacker may have already established footholds across the entire organisation.

Why Detection Is So Difficult

Lateral phishing is exceptionally difficult to detect using conventional security tools and methods. Several factors contribute to this detection challenge.

Legitimate sender identity: Because the emails come from real internal accounts, they pass all email authentication checks. There is no spoofed domain to flag, no mismatched sender information to analyse, and no external origin to filter.

Internal email routing: Many organisations apply less stringent security scanning to internal emails than to inbound external messages. Some secure email gateways do not inspect internal-to-internal traffic at all, creating a blind spot that lateral phishing exploits directly.

Contextual plausibility: An attacker with access to a compromised inbox can read existing email threads and craft messages that reference real projects, real conversations, and real business context. The phishing email does not just look legitimate; it is contextually appropriate, making it nearly impossible for the recipient to distinguish from a genuine message.

Trust bias: Employees have been conditioned to trust internal communications. Even well-trained employees who carefully scrutinise external emails may lower their guard when a message comes from a colleague they recognise. This psychological trust bias is the attacker's greatest asset in a lateral phishing campaign.

Detection Strategies for Lateral Phishing

Detecting lateral phishing requires a different approach from traditional phishing detection. Organisations need to look beyond sender verification and content analysis to identify behavioural anomalies that indicate account compromise.

Internal Email Scanning

Configure your email security solution to scan internal-to-internal messages with the same rigour applied to inbound external emails. While this introduces additional processing overhead, it closes the significant gap that lateral phishing exploits. Modern cloud email platforms offer native capabilities for internal message scanning, and third-party solutions can add this capability where native tools fall short.

Anomaly Detection on Sending Behaviour

Establish baselines for each user's normal email behaviour: the typical volume of emails sent, the usual recipients, the normal sending times, and the characteristic patterns of their communication. When a compromised account begins sending phishing emails, the behaviour often deviates from these baselines. An employee who normally sends 20 emails per day suddenly sending 200, or sending emails to contacts they have never communicated with before, should trigger an alert.

URL and Attachment Analysis for Internal Messages

Apply the same URL reputation checking, sandboxing, and attachment analysis to internal emails that you apply to external ones. If an internal email contains a link to a known phishing domain or an attachment with a malicious payload, the fact that it was sent from an internal account does not make it safe.

Impossible Travel and Unusual Login Detection

Monitor authentication logs for signs of account compromise. If an employee logs in from their usual location and then, minutes later, their account is accessed from a different country, this "impossible travel" pattern is a strong indicator that the account has been compromised. Similarly, logins from unusual devices, browsers, or IP addresses should be flagged for investigation.

User-Reported Suspicion of Known Contacts

Encourage employees to report emails that feel unusual, even if they come from known colleagues. If a message from a trusted coworker contains an unexpected link, an unusual request, or a tone that does not match their normal communication style, the recipient should feel empowered to verify the message through an alternative channel before acting on it. Building a culture where questioning internal emails is acceptable, not rude, is a critical component of lateral phishing defence.

Organisational Defences Against Lateral Phishing

Beyond detection, organisations can implement structural defences that limit the impact of lateral phishing even when it occurs.

Enforce Multi-Factor Authentication Universally

MFA does not prevent lateral phishing itself, but it significantly reduces the likelihood of the initial account compromise that makes lateral phishing possible. Ensure that every user account, without exception, is protected by MFA. Pay particular attention to service accounts, shared mailboxes, and legacy applications that may not support modern authentication methods.

Implement the Principle of Least Privilege

Limit the access and permissions of every account to only what is necessary for that employee's role. If a compromised account has administrative privileges or access to sensitive financial systems, the damage from lateral phishing escalates dramatically. By constraining what each account can do, you limit the blast radius of any single compromise.

Segment Email Communication Where Possible

Consider whether all employees truly need the ability to email everyone in the organisation. For very large organisations, restricting the ability to send all-staff emails to authorised accounts can prevent a compromised account from reaching the entire workforce in a single lateral phishing message.

Deploy Automated Response Capabilities

Configure your email platform to automatically quarantine messages from accounts that have been identified as compromised. When a compromise is detected, the system should immediately disable the account's ability to send email, revoke active sessions, and retroactively remove or quarantine messages that the compromised account has already sent. Speed is critical; every minute of delay gives the attacker more time to expand the campaign.

Conduct Internal Phishing Simulations

Include lateral phishing scenarios in your security awareness training programme. Simulations that appear to come from internal colleagues, or that mimic the style and context of real internal communications, prepare employees for the specific trust-exploitation techniques that lateral phishing employs. Employees who have experienced a simulated lateral phishing attack are significantly more likely to recognise and report the real thing.

Building Resilience Against the Internal Threat

Lateral phishing represents a fundamental challenge to the security model that most organisations have built over the past decade. That model assumed a clear boundary between trusted internal communications and untrusted external messages. Lateral phishing demonstrates that this boundary does not exist when accounts can be compromised and used as platforms for further attacks.

The shift in mindset required is significant but not insurmountable. Organisations must move from a trust-by-default model for internal communications to a verify-and-validate model that applies scrutiny to all messages, regardless of their origin. This does not mean creating a culture of paranoia. It means equipping employees with the knowledge that phishing can come from any source, providing them with easy mechanisms to verify unusual requests, and deploying technical controls that monitor internal email traffic with the same vigilance applied to external threats.

For small businesses, the good news is that the foundational defences against lateral phishing, including universal multi-factor authentication, internal email scanning, anomaly detection, and employee awareness training, are accessible and affordable. By implementing these measures, you dramatically reduce both the likelihood of the initial account compromise and the potential for that compromise to cascade through your organisation. In a threat landscape where the call is increasingly coming from inside the house, building resilience against lateral phishing is no longer optional.