In classic phishing, something looks "off": a strange domain, awkward wording, an unfamiliar sender. In Account Takeover (ATO), nothing looks off — because the email really comes from the real account of someone you know, with their real signature, from inside the real conversation history. SPF, DKIM, DMARC: all return PASS. The domain is correct. The sender is genuine. And that is exactly why ATO is the most dangerous scenario in corporate email security.
This article is part of our Thematic Series; it gathers in one place the mechanics, lifecycle, and defense of the "compromised account" scenario we reference again and again in our sector articles. The goal is the same as always: even a non-technical manager should get a clear answer to "how would this happen to us, how would we know, how do we stop it."
1. What Is ATO, and Why Can't "Authentication" Stop It?
Account Takeover is an attacker seizing control of a legitimate user's email account — by stealing the password, stealing the session cookie (token), or bypassing MFA. Once in, the attacker doesn't impersonate a fake identity; they use the real one.
The SPF/DKIM/DMARC trio from our first article answers "did this email really come from this domain?" In ATO the honest answer is "yes" — the email really did leave that account. So the authentication layer cannot see ATO by design. What's needed is a layer that asks "the sender is right, but is the behavior wrong?"
2. How Does an ATO Begin? (Entry Paths)
- Credential phishing: A fake Microsoft 365 / Google login page; the user "confirms" their password, the attacker captures it.
- MFA bypass via AiTM (Adversary-in-the-Middle): Modern phishing kits sit between the user and the real login page and steal the session cookie — directly seizing a session that has already passed MFA. This is where the "we have MFA, we're safe" assumption breaks.
- Password reuse / leaks: A password leaked on another service being reused on the corporate account (credential stuffing).
- Quishing and mobile: QR-code lures move the user off desktop protection and onto the phone; details in our quishing article.
3. Once Inside: The ATO Lifecycle
The moment of takeover is the beginning of the attack, not the end. The typical course:
- Silent reconnaissance: The attacker reads correspondence for days without sending a single email — learning who writes to whom and how, the payment flows, the tone and signature.
- Persistence and hiding: They set up hidden forwarding rules (auto-deleting certain messages or copying them to an external address) so the real user notices nothing. Often they add an application permission (OAuth) to retain access even if the password changes.
- Internal lateral movement: From the compromised account they email colleagues — "internal" emails are the most trusted. One account can topple an entire organization like dominoes.
- Cashing out: Right in the middle of a genuine payment conversation, at the perfect moment, a bank change or fake invoice enters. Every "from a compromised account" case in our sector articles is this step.
4. Why Does Gateway-Based Protection Miss ATO?
Traditional email security gateways (SEGs) scan traffic at the organization's border, on the way in/out. But ATO's most dangerous moves are internal traffic: an email from a compromised account to another employee never crosses the org boundary — the SEG never sees it. This is the clearest example of why API-based architecture is necessary; we detailed the distinction in our API vs Gateway article. An API-based solution connects directly to Microsoft 365 / Google Workspace and sees internal emails, login anomalies, and mailbox rule changes too.
5. How Do You Detect and Stop ATO?
Technology
Check Point Harmony Email & Collaboration provides these ATO-specific capabilities:
- Login-anomaly detection: Impossible travel (Istanbul-Vietnam in 5 minutes), unrecognized device/IP, unusual hours — the first signals of takeover.
- Mailbox-rule monitoring: Suddenly created hidden forwarding/deletion rules and new OAuth permissions are flagged — catching the persistence step.
- Internal-traffic analysis: Contextually detects abnormal emails (tone, request, urgency deviation) from a compromised account to colleagues.
- Automated response: Terminating a suspicious session, quarantining the account, retroactively pulling sent malicious emails from all mailboxes (post-delivery remediation).
Process and People
- Phishing-resistant MFA: FIDO2/passkeys instead of SMS/approval codes — the strongest layer against AiTM session theft.
- Payment-confirmation rule: A second-channel call-back on bank changes and above-threshold payments (the shared rule of our sector articles) — stops the ATO cash-out step even when the account is genuine.
- Awareness: An "internal email isn't always safe" culture; the reflex to question unusual internal requests too.
Frequently Asked Questions
We have MFA — isn't that enough against ATO?
MFA is a critical layer but not magic. AiTM phishing kits can bypass MFA by stealing the session cookie; and OAuth permissions and app passwords can open side doors that circumvent MFA. FIDO2/passkey-based, phishing-resistant MFA largely closes this gap — but the detection/response layer is still needed.
How do we know an account has been taken over?
Early signals are usually technical and silent: logins from unexpected locations, mail rules that appeared on their own, "I sent it but it's not in my sent items" situations, colleagues reporting "I got a strange email from you." Rather than waiting for a human to notice these, automated monitoring is essential.
What should we do first when an account is taken over?
In order: terminate sessions globally, reset the password, re-enroll MFA, clean up hidden mail rules and unauthorized OAuth permissions (the most-skipped step — these sustain access even after a password change), and retroactively clean the emails sent from that account. A plan should be written in advance.
Why would a mid-size firm like ours be a target?
ATO is an automated business; the attacker doesn't hand-pick organizations, they mass-try leaked password pools. Mid-size firms are high-yield targets precisely because phishing-resistant MFA and a detection layer are usually missing.
What Should You Do Now?
One question: "If an employee's account were taken over today, would we notice — or would we first hear about it from a defrauded customer?" If it's the latter:
- Free Field Audit: Alongside your authentication report card, we assess your ATO-exposed surface (MFA maturity, internal-traffic visibility).
- 14-Day Check Point Trial (monitor mode): Missed items reported, including login anomalies, suspicious mail rules, and internal-traffic risks.
About this article: Part of our Thematic Series; it deepens the mechanics of the "compromised account" scenario referenced across our sector articles. Kinetik Bilişim is the Türkiye partner of Check Point Software Technologies at the Advanced Partner 2026 level, holding Email, Endpoint & Browser, Mobile, and SASE Solution Specialization accreditations. The author, Kemal Özleyen, is a cybersecurity engineer certified as a Check Point Workspace Security Expert.
