We have received a phishing email trying to get money from us, this email came from an account that was spelled closely to our work email but not quite the same.

I have looked up the domain and found it was apparently set up yesterday.

My true concern is that the e-mail was RE:<SUBJECT> where the subject and recipients were all part of a real internal email chain. The email was not really a reply but the subject was correct and was from an email sent hours earlier.

What sort of compromise in my (G-suite) system would allow someone to be able to read subjects but not have full access to the email itself?

Other then full password re-sets should I be concerned about additional holes?


Have you already considered that it might just be coincidence? If the subject was something common, it might not even be a compromise, just a lucky guess. If it wasn't something that obvious, how about these?

In decreasing order of probability:

  • One of your employees is doing the phishing

  • Do you have a BYOD policy? Maybe one of their phones has been compromised. Or their laptops for that matter.

  • One compromised system belonging to any user on the domain (keylogged maybe?)

Honestly, just wait it out. If you've reset all passwords, that should lock out the attacker, at least temporarily. Next go about scrubbing all their computers and remove anything suspicious. If this fails and you receive any more spam, begin resetting passwords in batches - and keep narrowing down your suspects (painful, do not recommend).

| improve this answer | |

I have two hypothesis, but eventually I think this question will lead to a guess game, unless you have more relevant data.

1) No one got access to your email, but to your workstation (or your coworker's). This is the most common vector of intrusion to an infrastructure.

2) Maybe the phisher is just one of your coworkers trying to get some extra income, and therefore, that's why he has the real content of the email and know who were the recipients of that email chain.

| improve this answer | |
  • 4
    Another option is a work email automatically forwarded to another compromised account. – user123931 Dec 21 '16 at 19:16
  • I think this seems to be the most likely thing. There is nothing stopping the email chain having been forwarded out of the company network either by mail redirect or someone intentionally forwarding work to a home email - or being bitter about something going on at work. – R. Murray Dec 21 '16 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.