{"id":21442,"date":"2022-02-24T15:31:04","date_gmt":"2022-02-24T15:31:04","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=21442"},"modified":"2025-05-07T21:56:36","modified_gmt":"2025-05-07T21:56:36","slug":"lateral-phishing-detection-and-prevention","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/lateral-phishing-detection-and-prevention\/","title":{"rendered":"Lateral Phishing: Detection and Prevention"},"content":{"rendered":"

Phishing attacks continue to emerge across the globe bringing new challenges to businesses and individuals. <\/span>Studies indicate<\/span><\/a> that 92% of phishing malware is delivered by email. It proves that cybercriminals prefer spreading fraud through emails. We\u2019ve talked about various phishing types on our blog, but in this article, we\u2019re discussing <\/span>lateral phishing<\/b>.<\/span><\/p>\n

It\u2019s a specific type of email phishing with unique tactics hackers use to bring success to their trickery. Read on to discover everything related to<\/span> lateral phishing attacks<\/b> and the main principles of its detection and prevention.\u00a0<\/span><\/p>\n

What is Lateral Phishing?<\/b><\/h2>\n

Lateral phishing<\/b> is a kind of cyberattack where the phishing email comes from a corporate email address. Commonly, a <\/span>lateral phishing attack<\/b> starts with an account takeover. The attacker then learns about the company\u2019s inside and outside communications, and can send more malicious emails\u2014effectively spreading the impact of the attack.<\/span><\/p>\n

The attack goals can include credential theft, money transfers, malware spread, and other dire outcomes. This is an ever-expanding type of cyber attack. As such, <\/span>detecting and characterizing lateral phishing at scale <\/b>is crucial for businesses of all sizes<\/span>.<\/b><\/p>\n

How Do Lateral Phishing Attacks Work?<\/b><\/h2>\n

The main success guarantee of<\/span> lateral phishing <\/b>is the trust the attacker obtains. <\/span>A lateral phishing attack <\/b>is sent from a legitimate but compromised email account which makes the victim believe the information or request\u00a0 is reliable and legitimate..\u00a0<\/span><\/p>\n

After gaining access to a company\u2019s email account, attackers can send emails to tens or hundreds of other company email addresses.<\/span><\/p>\n

Even worse, they can access external communications. Now, imagine what would happen if the compromised account belonged to an executive with access to partners and financial information.<\/span><\/p>\n

The next step, depending on the hacker\u2019s strategy, would be to impersonate the account owner and send phishing messages. These could be intricately-designed or as broad-catch as needed.<\/span><\/p>\n

The rest works similarly to other <\/span>phishing email<\/span><\/a> techniques., Typically, lateral phishing attackers use tactics like these\u00a0 to convince recipients to take some sort of action (like clicking on a link, divulging sensitive information, or making payments):<\/span><\/p>\n