Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

Compromised vendor mailbox → reply-chain phishing → client compromise

Take over a vendor / partner mailbox via AITM phishing. Reply to an existing thread with a malicious link — trust transferred from the genuine prior conversation defeats most user training.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: a B2B relationship where vendor and client exchange documents regularly. Vendor mailbox compromised via earlier AITM / device-code phishing.

§ Steps

  1. 01
    Payload runs on client workstationExecution
    T1059— Command and Scripting Interpreter
  2. 02
    Send from compromised mailboxInitial Access
    T1566— Phishing
  3. 03
    Client opens (real thread, real sender)Execution
    T1204— User Execution
  4. 04
    Find active client conversationCollection
    M365-EWS-EXFIL— Exchange Web Services (EWS) Exfil
  5. 05
    Compromise vendor mailbox (AITM)Initial Access
    PH-AITM-EVILGINX— AITM Phishing — Evilginx / Modlishka
  6. 06
    Draft reply with malicious link / attachmentInitial Access
    EM-CONVERSATION-HIJACK— Conversation Hijacking / Reply-Chain Attack

§ References

§ Frequently asked

What is the "Compromised vendor mailbox → reply-chain phishing → client compromise" attack path?
Take over a vendor / partner mailbox via AITM phishing. Reply to an existing thread with a malicious link — trust transferred from the genuine prior conversation defeats most user training. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Payload runs on client workstation (T1059) — a execution primitive. Assumed environment: a B2B relationship where vendor and client exchange documents regularly.
What is the final impact of this kill-chain?
The final step lands on Draft reply with malicious link / attachment (EM-CONVERSATION-HIJACK), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers