Account takeover (ATO) is an attack where a criminal gains control of a legitimate user's account, using stolen credentials, phished MFA codes, session theft or OAuth abuse, and operates from inside it. Email ATO is the most damaging variant: the mailbox is the reset key to every other account and the trust anchor for every colleague and customer.
Key facts
- Entry routes: credential phishing, password reuse from breaches, adversary-in-the-middle kits that proxy MFA, and consent phishing that skips credentials entirely.
- Once inside, attackers read quietly first: invoice cadence, key relationships, payment processes. The fraud comes later, timed and informed.
- Mail rules (auto-forward, auto-delete) are the classic persistence trick, keeping access and hiding replies even after password changes.
What attackers do inside a mailbox
Reconnaissance (search for "invoice", "payment", "password"), lateral spear phishing (attacks sent to colleagues and customers from the trusted account, with near-perfect success rates), thread hijacking for vendor email compromise and BEC, data theft, and downstream resets: with the mailbox, they reset SaaS accounts, banking portals and cloud consoles. An email ATO is rarely the goal; it is the platform.
Detection: behavior, not credentials
The login looks legitimate by definition. What deviates is behavior: sign-in geography and device changes, new mail rules, unusual search activity, sending patterns that break the account's history, OAuth grants appearing on the account. Post-login behavioral monitoring is therefore the detection layer that matters, alongside the mail-flow view: lateral phishing from a compromised account looks wrong against the relationship graph even when the sender is technically genuine. Today Sentaro's Message vector evaluates internal mail as well as inbound, so lateral phishing from a compromised account is judged like any other message, and the App vector surfaces OAuth grants on the account. Post-login deviation analysis (anomalous sessions, mail-rule and forwarding abuse, impossible travel) arrives with Sentaro's Behavioral vector, which reaches general availability in Q4 2026.
How to defend
Phishing-resistant MFA (passkeys/FIDO2) closes the credential and MFA-fatigue routes; conditional access limits where sessions work; OAuth consent policies close the token route. Detection-side: monitor for new mail rules, impossible travel and behavioral breaks, and treat any of them as an incident, not a curiosity. Have a takeover runbook ready: kill sessions, revoke tokens and rules, reset, then scope what was read using real evidence.