Verify Login Requests Immediately to Stop AI-Enhanced Account Takeovers
Attackers use generative AI to steal credentials, then wait quietly before exploiting trust to target payroll, suppliers and customers.
Key points
- Generative AI simplifies phishing, allowing attackers to mimic trusted colleagues or create convincing fake login pages.
- Compromised accounts bypass traditional email security because the sender is a legitimate, verified user.
- Attackers often delay action to monitor traffic and identify optimal moments for financial or data theft.
Small-business owners face a growing threat where attackers hijack legitimate email accounts to impersonate trusted individuals without triggering security warnings. According to a report by The Register, this account takeover method allows threat actors to steal money, exfiltrate sensitive data and spread malware while appearing as normal business activity.
The attack lifecycle begins with credential theft, often facilitated by generative AI that crafts convincing phishing messages. Once inside, attackers do not immediately launch obvious attacks. Instead, they verify their access and monitor email traffic to understand internal communication patterns and identify weak points within the organization.
The Stealthy Approach
Dave Baggett, SVP of Cybersecurity at Kaseya, notes that attackers have shifted from immediate spam blasts to a more patient strategy. They sit tight after gaining access, observing ongoing conversations to find the perfect moment to inject themselves. This stealthy behavior makes detection difficult because the compromised account behaves like a normal user for a period before weaponizing its access.
Who Is at Risk
The initial target is often an employee whose credentials are stolen through AI-generated phishing attempts. However, the ultimate victims can extend far beyond the initial breach. Attackers may target internal systems like payroll or invoicing databases for financial gain. They also use the compromised account to launch outbound phishing campaigns against customers and suppliers, expanding the scope of the attack.
What to watch
Teams should monitor for unusual login patterns or delayed responses from key staff members who may have been compromised. Watch for unexpected requests for sensitive data or changes to payment details, even if they come from known contacts. Be alert to emails that seem slightly off in tone or context, as AI-generated messages may lack subtle organizational nuances.
What made it possible
This attack relies on the inherent trust placed in authenticated email accounts. Traditional security tools validate the sender's identity but cannot assess intent, allowing malicious activity from legitimate accounts to pass unnoticed. The weakness lies in the assumption that a verified login equals benign behavior. Attackers exploit this gap by using stolen credentials to blend in with normal traffic, making detection reliant on behavioral anomalies rather than signature-based alerts.
Background: Account takeover
Account takeover occurs when an attacker gains unauthorized access to your credentials. It rarely involves complex hacking. Instead, attackers use stolen data, social engineering, or session flaws to impersonate you. Securing the login flow and verifying identity changes prevents most of these intrusions.
Read the full guide: Account Takeover: How Attackers Bypass Login Security
What to do and how to stay safe: Kaseya
- Verify all requests for money or sensitive data through a secondary channel, such as a phone call or in-person conversation.
- Enforce multi-factor authentication on all email accounts to add a layer of security beyond passwords.
- Train staff to recognize AI-generated phishing attempts, including messages that mimic colleagues or use urgent language.
- Monitor account activity for unusual login times or locations that may indicate unauthorized access.
Step-by-step guide: Multi-Factor Authentication Setup for Small Teams
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How do attackers avoid detection after stealing an email account?
They delay their actions to monitor email traffic and understand communication patterns, allowing them to blend in with normal activity.
What role does generative AI play in these attacks?
Generative AI makes it easier for attackers to create convincing phishing messages and fake login pages to trick users into revealing credentials.
Who are the ultimate targets of these account takeovers?
While employees are the initial targets, attackers often aim to compromise customers, suppliers and internal financial systems like payroll.
