Tag: EAC

How BEC (Business Email Compromise) and EAC (Email Account Compromise) Work, and How Proofpoint + EAC Controls Stop Them
Introduction

BEC (Business Email Compromise) and EAC (Email Account Compromise) are the two most financially damaging email-based attacks today.
They bypass traditional spam filters, they target humans—not firewalls—and they abuse trust instead of malware.

Microsoft 365 alone cannot fully protect against these attacks.
That’s why organizations use Proofpoint, DMARC alignment, and strict authentication controls—to verify identity, stop impostors, and prevent fraudulent requests from reaching inboxes.

This blog explains:
- How BEC works
- How EAC happens
- What attackers exploit
- Why RFC email standards make impersonation easy
- How Proofpoint + EAC controls shut these attacks down
Perfect material for any advanced interview panel.

What Is Business Email Compromise (BEC)?

BEC is when attackers pretend to be:
- your CEO,
- your CFO,
- your HR director,
- a vendor,
- or someone with financial authority
…with the goal of manipulating employees into:
- wiring money
- changing direct deposit info
- sending W-2s
- releasing confidential documents
- approving purchases
🔸 The key point:

BEC uses identity deception, not malware.
No attachments.
No links.
Just social engineering in a clean email.

How BEC Works (Step-By-Step)

1. Reconnaissance

Attackers scrape:
- LinkedIn
- Company directory leaks
- Press releases
- Vendor invoices
- Social media
They map who communicates with whom.

2. Identity Impersonation

They spoof:
- Display names
- Envelope sender
- Reply-To address
- SPF-valid lookalike domains
Example:
[email protected] →
[email protected]

3. Thread Hijacking

They do this by compromising a vendor mailbox and replying inside an existing email chain.

4. Social Engineering

The attacker sends a “clean” request:
- “Are you available?”
- “I need this wire sent ASAP.”
- “Can you update this banking information?”
5. Financial Fraud

Once the attacker has the employee’s trust — the money is gone.

What Is Email Account Compromise (EAC)?

EAC is when the attacker actually logs in to a real mailbox.

Not spoofing.
Not faking.
Real access.

How they gain access:
- MFA fatigue
- Password reuse
- Legacy protocol with no MFA
- OAuth token theft
- Malware stealing credentials
- Phishing pages identical to Microsoft login
Once inside, attackers:
- Set up hidden forwarding rules
- Delete MFA alerts
- Change mailbox rules
- Hijack vendor threads
- Sit silently and wait for financial conversations
EAC is dangerous because the attacker uses your real domain, your real mailbox reputation, your real account.

This is why simply having SPF, DKIM, and DMARC does not stop EAC.

Why Proofpoint Is Needed (Beyond RFC Email Standards)

RFC email standards allow spoofing by design.

Attackers can:
- abuse SMTP commands
- spoof the “MAIL FROM”
- spoof the “From:” header
- use free SMTP servers
- harvest SPF/DKIM values via nslookup
- build near-perfect domain clones
Example:
```
nslookup -type=txt _dmarc.victim-domain.com
nslookup -type=txt selector._domainkey.victim-domain.com
```
Attackers see your exact SPF/DKIM configuration.
They spoof accordingly.

This is why relying on RFC standards alone is not enough.

How Proofpoint Stops BEC and EAC

1. Identity Protection

Proofpoint checks:
- display name anomalies
- domain lookalikes
- impossible travel
- VIP impersonation attempts
- internal vs external identity mapping
- “Reply-To mismatch”
- “Header vs Envelope mismatch”
Microsoft EOP can do part of this,
Proofpoint does it with far more accuracy.

2. Vendor Fraud Protection

Proofpoint fingerprints:
- vendor sending behavior
- previous conversation style
- writing style
- IP reputation
If a vendor mailbox is compromised, Proofpoint detects the “change in sending personality.”

This is one of the strongest EAC protections in the industry.

3. DMARC Enforcement + Lookalike Domain Defense

Proofpoint enforces:
- Domain alignment
- Display name behavior
- Header-from authentication
- Cross-identity matching
Lookalike domains” examples (generic only):
- company-secure.com
- companny.com
- c0mpany-support.com
- company-mailservice.com
These would pass traditional email filters.

4. URL and Payload Isolation

Even if links look clean, Proofpoint re-writes and detonates them.

Although BEC rarely has links, EAC-based phishing almost always does.

5. Machine Learning on Human Behavior

Proofpoint analyzes:
- who talks to whom
- frequency
- direction
- urgency phrases
- tone manipulation
If the CEO normally never emails accounting at 10:30 PM on a Friday — the message gets flagged.

Real-World Example (Anonymized)

A vendor’s mailbox was compromised.
The attacker replied inside an existing thread asking to update bank account numbers.

Microsoft EOP didn’t block it — it came from a legitimate vendor domain.

Proofpoint flagged:
- anomalous IP
- unusual writing style
- “conversation thread hijacking detected”
- vendor identity risk score
Proofpoint blocked the message before it reached the user’s mailbox.

This is exactly why companies invest in Proofpoint.

Conclusion

BEC and EAC are no longer “IT problems.”
They are financial crimes, costing billions worldwide.

Microsoft 365 gives strong baseline protection,
but attackers today use identity manipulation, social engineering, and thread hijacking that bypass traditional signals.

Proofpoint closes those gaps with:
- identity defense
- behavioral AI
- vendor fraud detection
- DMARC enforcement
- mailbox compromise detection
- impersonation protection
© 2012–2025 Jet Mariano. All rights reserved.
For usage terms, please see the Legal Disclaimer.
November 22, 2025
Fixing “Sender not allowed” to an internal group (Exchange Online) — a quick forensic + runbook
POST BODY

When a partner emailed our all-hands list, they got an NDR:
“the group only accepts messages from people in its organization or on its allowed senders list… sender not allowed.”

We’d solved this once before and didn’t capture the steps. This time we did.

Forensic summary (redacted)
- group: all@[corp-redacted].com
- external sender: firstname.lastname@[partner-redacted].com
- symptom: NDR “sender not allowed”
- root causes:
  1. the group required authenticated (internal) senders only, and
  2. the external wasn’t on the group’s allowed-senders list
- gotcha we hit: New-MailContact failed with ProxyAddressExists — an existing MailUser already owned the external SMTP, so we reused it instead of creating a new contact
Straight line (what fixed it)
1. identify group by SMTP and check whether it’s a DL or a Microsoft 365 Group
2. locate the external as an existing MailContact/MailUser (include soft-deleted objects)
3. add that object to the group’s AcceptMessagesOnlyFromSendersOrMembers list
4. allow the group to accept external senders (keeps the allow-list in effect)
5. test and confirm with Message trace
Reusable runbook (PowerShell, redacted)
```
# 0) Connect
Connect-ExchangeOnline

# 1) Variables (edit these)
$GroupSmtp = "all@[corp-redacted].com"
$ExternalAddresses = @("firstname.lastname@[partner-redacted].com")

# 2) Resolve the group (works for DL or M365 Group)
$grp = Get-EXORecipient -Filter "PrimarySmtpAddress -eq '$GroupSmtp'"
$grp | fl Name,RecipientTypeDetails,PrimarySmtpAddress,Identity,ExternalDirectoryObjectId

# 3) Ensure each external exists as a recipient we can allow (MailContact/MailUser).
#    If already present (or soft-deleted), reuse it.
$recips = @()
foreach ($addr in $ExternalAddresses) {
  $r = Get-EXORecipient -ResultSize Unlimited -IncludeSoftDeletedRecipients `
       -Filter "PrimarySmtpAddress -eq '$addr'"
  if (-not $r) {
    try { New-MailContact -Name $addr -ExternalEmailAddress $addr | Out-Null
          $r = Get-EXORecipient -Filter "PrimarySmtpAddress -eq '$addr'" }
    catch { Write-Host "Contact already exists somewhere: $addr" }
  }
  $recips += $r
}
$recips | ft Name,RecipientTypeDetails,PrimarySmtpAddress -AutoSize

# 4) Add externals to allow-list AND allow external senders
if ($grp.RecipientTypeDetails -eq "GroupMailbox") {
  # Microsoft 365 Group (Unified Group)
  foreach ($r in $recips) {
    Set-UnifiedGroup -Identity $grp.ExternalDirectoryObjectId `
      -AcceptMessagesOnlyFromSendersOrMembers @{Add=$r.Identity}
  }
  Set-UnifiedGroup -Identity $grp.ExternalDirectoryObjectId -AllowExternalSenders:$true
  Get-UnifiedGroup -Identity $grp.ExternalDirectoryObjectId |
    fl DisplayName,PrimarySmtpAddress,AllowExternalSenders,AcceptMessagesOnlyFromSendersOrMembers
} else {
  # Distribution Group / Mail-enabled Security Group
  foreach ($r in $recips) {
    Set-DistributionGroup -Identity $grp.Identity `
      -AcceptMessagesOnlyFromSendersOrMembers @{Add=$r.Identity}
  }
  Set-DistributionGroup -Identity $grp.Identity -RequireSenderAuthenticationEnabled:$false
  Get-DistributionGroup -Identity $grp.Identity |
    fl DisplayName,PrimarySmtpAddress,RequireSenderAuthenticationEnabled,AcceptMessagesOnlyFromSendersOrMembers
}

# 5) Message trace (adjust window)
Get-MessageTrace -SenderAddress $ExternalAddresses[0] -RecipientAddress $GroupSmtp `
  -StartDate (Get-Date).AddHours(-2) -EndDate (Get-Date) |
  ft Received,Status,RecipientAddress,MessageId
```
Common pitfalls we saw (and how we handled them)
- ProxyAddressExists on New-MailContact → an existing MailUser/Contact already holds that SMTP; reuse it (or permanently remove the soft-deleted recipient first).
- group can’t be found by display name → target by SMTP with Get-EXORecipient -Filter "PrimarySmtpAddress -eq '...'".
- delivery still blocked after allow-list → the DL still required authenticated senders; set RequireSenderAuthenticationEnabled:$false (DL) or AllowExternalSenders:$true (M365 Group).
Click-path (EAC, if you don’t want PowerShell)
- Recipients → Contacts → add/find the partner’s contact
- Recipients → Groups → open the group → Delivery management → “Accept messages from” → add the contact
- For DLs: turn off “Require sender authentication”
- For M365 Groups: enable “Allow external senders”
Prevention / hygiene
- keep an “Authorized External Senders — all” mail-enabled security group; allow that group on the DL/M365 Group, then just add/remove partner contacts over time
- document the NDR verbatim and the message trace ID when you close an incident
Redaction note

All addresses and names are redacted. Replace with your real SMTPs when running the script.

© 2012–2025 Jet Mariano. All rights reserved.
For usage terms, please see the Legal Disclaimer.
September 3, 2025

Tag: EAC

How BEC (Business Email Compromise) and EAC (Email Account Compromise) Work, and How Proofpoint + EAC Controls Stop Them

Introduction

What Is Business Email Compromise (BEC)?

🔸 The key point:

How BEC Works (Step-By-Step)

1. Reconnaissance

2. Identity Impersonation

3. Thread Hijacking

4. Social Engineering

5. Financial Fraud

What Is Email Account Compromise (EAC)?

How they gain access:

Once inside, attackers:

Why Proofpoint Is Needed (Beyond RFC Email Standards)

How Proofpoint Stops BEC and EAC

1. Identity Protection

2. Vendor Fraud Protection

3. DMARC Enforcement + Lookalike Domain Defense

4. URL and Payload Isolation

5. Machine Learning on Human Behavior

Real-World Example (Anonymized)

Conclusion

Fixing “Sender not allowed” to an internal group (Exchange Online) — a quick forensic + runbook

POST BODY

Forensic summary (redacted)

Straight line (what fixed it)

Reusable runbook (PowerShell, redacted)

Common pitfalls we saw (and how we handled them)

Click-path (EAC, if you don’t want PowerShell)

Prevention / hygiene

Redaction note