One Clicked Link, 6,600 Emails: How Compromised Mailboxes Carry Phishing Further

Phishing was the most common way into organisations that Cisco Talos Incident Response helped in the second quarter of 2026. According to the Talos IR Trends Q2 2026 report, it accounted for over half of the engagements where the initial access route could be determined, up from 35 percent the quarter before. That headline is useful, but the detail underneath it matters more for anyone running a mail system: what the attacker did with the mailbox once the first person had been phished.

What the Talos report found

Talos reports that authentication abuse was the most prevalent security weakness of the quarter, seen in 65 percent of engagements (35 percent the quarter before). The techniques listed include adversary-in-the-middle proxies, session token theft, MFA fatigue, registration of attacker-controlled devices and legacy authentication protocols.

For lateral movement, the technique Talos saw most often was internal spearphishing. In plain terms, that means an attacker who has control of one real mailbox uses it to send convincing messages to people inside the same organisation and to the contacts that mailbox already knows. Talos also flagged a second weakness: unlimited outbound email thresholds, which it says let attackers spread malicious activity in almost 15 percent of engagements.

Why a message from a colleague gets through

Most phishing awareness teaches people to look for the odd one out: an unfamiliar sender, a strange domain, a message that arrives from nowhere. Internal spearphishing removes those clues. The sender is a real colleague, the address is correct, the writing style may match earlier threads, and the message may sit in the middle of a conversation that is already under way. Mail filtering often applies more trust to internal and long-established correspondence, which is a reasonable default that attackers are happy to borrow.

That does not make people the weak point. It means the usual cues have been taken away, so the checks have to move to the things a person can still verify: what is being asked, how unusual the request is for that sender, and whether there is a second route to confirm it.

One click, more than 6,600 emails

Talos describes one engagement in which a user clicked a phishing email, which led to credential theft and account compromise. The attacker then sent over 6,600 phishing and spam emails from the compromised account to continue the attack chain. Talos does not say how many of those messages were opened or acted on, so the figure shows how far a single mailbox can reach rather than how many people fell for it.

The diagram below shows the pattern in simplified form. It is illustrative, not a measured spread, but it captures why an outbound limit matters: the first phish may be one email, and the compromised mailbox can turn it into thousands.

The QR code inside the PDF

The report also describes UAT-11764, a persistent QR code phishing campaign that mainly targeted Australian organisations. Talos says it uses auto-generated, victim-tailored PDF documents containing QR codes, relies on trusted infrastructure such as SharePoint and Microsoft 365, and uses compromised Microsoft 365 accounts to harvest credentials. Talos assesses with high confidence that the actor will keep running the operation and expand it through the contact lists of each compromised mailbox.

The QR code is worth pausing on. Scanning one with a phone moves the person from a managed laptop, where email filtering and browser protections apply, onto a personal device that often has none of them. Combined with a sender they already know, it is a well-chosen route.

Where authentication fits underneath

Talos also describes ARToken, a phishing-as-a-service platform closely linked to EvilTokens, with more than 80 API endpoints for device code phishing. Talos says it lets attackers bypass MFA through the OAuth device authorisation flow rather than by stealing passwords. We covered the wider EvilTokens story in our earlier post on the takedown.

The connection to the mailbox problem is simple. A stolen token or session is as good as a stolen sign-in, and a mailbox that has been taken over is the launch point for the next round of messages. Talos recommends moving from push and SMS based MFA to phishing-resistant methods such as FIDO2 and WebAuthn security keys.

What to do about it

• Set outbound email limits. Talos calls strict outbound thresholds a low-effort, high-impact mitigation. Cap how many messages and recipients one account can send in a given period, and alert when it is hit.
• Move towards phishing-resistant MFA. Where it is not yet possible, use number matching or verified push, restrict self-service MFA enrolment and block legacy authentication through Conditional Access.
• Treat QR codes in PDF attachments with suspicion. Talos advises blocking or flagging them, and monitoring for suspicious inbox rule creation and unusual SharePoint file staging.
• Keep at least 90 days of logs. Talos recommends a minimum of 90 days of retention in a central logging platform, so a compromised mailbox can be traced back to the first sign-in.
• Make reporting easy and fast. When an internal message looks wrong, the person who spots it should be able to report it in one step, and the report should reach someone who can act on it quickly.
• Agree a second channel for unusual requests. A quick call or chat message to the apparent sender settles most doubts, even when the email looks genuine.

Phishing simulations and awareness training help here by building the habit of reporting, including for messages that appear to come from inside the business. They are one layer, not a guarantee, and they work best alongside the technical controls above.

The bottom line

The first phishing email in an incident is often only the start. The messages that follow can come from a real colleague, carry a QR code that moves the victim to a phone, and run into the thousands if nothing limits the mailbox. Talos found authentication abuse in 65 percent of engagements and unlimited outbound thresholds helping spread in almost 15 percent. Both are controls an organisation can change this quarter, and both give people a fair chance when a familiar name sends something unfamiliar.

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.