Resources / Sender Security

Anatomy of an email attack

A message arrives. Maybe it looks like an invoice from a supplier, or a shared document, or a note from the CEO asking for something urgent.

The sender looks familiar. The recipient does what it asks.

That moment is the end of an attack that may have taken weeks. To understand it, start at the inbox and work backward. Our crash course in email security tells the same story in the other direction, from the sender forward.

1. What does the attacker want?

Delivery is not the goal. The message exists to get one person to do one thing:

Give up an account. A fake login page takes a password, a one-time code or a session token.
Run something. A file or a download installs malware or ransomware.
Move money. A payment is sent, or bank details are changed. Nothing on the computer needs to be compromised.
Hand over information, such as payroll records or tax documents.
Build trust for later. A harmless first message confirms an address or starts a conversation.

Business email compromise, the money case, cost $3.05 billion in complaints to the FBI in 2025. Each of these needs the recipient to trust the message enough to act. Everything before delivery exists to earn that trust.

2. What does the message need?

A reason to act that fits the recipient's day: an invoice, a signature, a password that is about to expire, a supplier with new bank details. And something to act on: a link, an attachment, or plain instructions. The payload does not have to be software. A fraudulent payment instruction is as damaging as malware, and no scanner finds anything in it.

3. Whose name goes on it?

Identity	Why an attacker picks it	What gets in the way
Display name impersonation	Simple and cheap.	The address itself gives it away to anybody who looks.
Lookalike domain	The attacker controls the domain, and it passes its own checks.	A new domain has to build credibility, and it can be found.
Direct domain spoofing	Uses the real name of an established organization.	DMARC at reject stops it at receivers that honor the policy.
Compromised account	Inherits the identity, the history and the relationships.	The attacker needs access to a real account first.

A lookalike is a separate identity that the attacker fully controls. In one case prosecuted in New York, messages came from accounts on a domain "very similar" to a legitimate one. In a case in Maryland, a jury heard that the defendant registered spoofed domain names to pose as a charity's employees. Such a domain can pass SPF, DKIM and DMARC. That only proves the attacker is allowed to send from the domain they registered.

An account takeover goes further. The attacker writes from the real mailbox, in an existing conversation, and all three checks pass because they are working correctly. The FBI has described how attackers then set mailbox rules to delete key messages and forward mail outside.

4. How does it reach the inbox?

The attacker's own servers, with records set up for their own domain.
A compromised mailbox, with its reputation and its contact list.
A legitimate service, such as a marketing platform, help desk or document signing tool. The sending is real and correctly authenticated. The content is not.
A gap in the receiver. Microsoft 365's Direct Send feature was abused to deliver internal-looking mail to more than 70 organizations, in one sample delivered despite dmarc=fail.
No conventional email at all: a calendar invitation, a shared document notification, or a chat message.

5. Who is worth the effort?

An attacker looks for the person whose actions advance the attack, who is not always the most senior. Accounts payable handles invoices. An executive assistant sees the calendar. IT administrators hold identity systems. The relationships are worth as much as the people: a fraudulent invoice is believable when it comes from a real supplier, and one compromised supplier can reach dozens of customers.

6. Where did all of that come from?

Most of it is public. Company websites and job postings name people and technology. A naming convention turns a name into an address. And DNS tells anyone who asks which mail service you use, which services may send as you, and whether your DMARC policy would stop a forgery. That last part decides which attack is cheapest against you.

The attack is a chain, not an email

Consider a supplier's mailbox that is compromised. The attacker reads the invoice conversation, writes from the real account, and asks for payment to a new bank account. There is no attachment, no malware and no fraudulent domain. Every check passes. A mass phishing run, by contrast, registers a domain and sends to a purchased list. Both end with a message in an inbox, and they share almost nothing else. No single signature finds both.

What this means for defense

Your domain. Know who sends as you and reach DMARC reject, so your exact name cannot be forged.
Names like yours. DMARC cannot see them. Watch for them and block the dangerous ones.
Accounts. Phishing-resistant MFA, conditional access, and alerts on new mailbox rules and forwarding.
Content. Filtering for malware, links and impersonation. This belongs to your mail provider or gateway.
Process. Confirm any change of bank details through a channel that the message did not supply.

Authentication proves something about a domain, not about a person or their intent. A message can pass everything and still be fraud. The question is whether the identity, the infrastructure and the context behind it can be trusted.