"Now they are starting to get clever. They’ll get access to an account and sit tight, watching all the email traffic passing and waiting for an opportune moment to inject themselves into the conversation," says Dave Baggett, SVP Cybersecurity with software developer Kaseya.
How account takeover unfolds
Account takeover begins, the source lays out, with the theft of legitimate credentials—most commonly through phishing. Generative AI (GenAI) makes those phishing lures easier to craft and more convincing, whether by posing as a colleague or by constructing fake login pages designed to extract credentials. Once an attacker has valid logins, the playbook has shifted away from immediate disruption. Rather than "firing off spam and phishing," attackers often sit and observe, mapping conversation flows, relationships and potential weak points before acting.
From a hijacked inbox to outbound compromise
With reconnaissance complete, an assailant weaponizes the hijacked identity. The immediate targets can be internal—payroll and invoicing systems—but the more damaging move is outbound phishing aimed at customers and suppliers. Messages that appear to come from a trusted partner are especially effective: while an organisation can harden its own accounts with multifactor authentication (MFA) and other controls, it cannot enforce those protections on third parties. As Baggett puts it, “Our customer has no idea what is or isn’t protecting that third party.”
Impersonation of senior staff compounds the danger. Conventional filtering is often configured to reduce friction for executives, and recipients may be reluctant to question what appears to be an authentic message from a C-level sender. The result is an exploited layer of trust that allows attackers to expand their reach without tripping traditional technical alarms.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildINKY and Kaseya SaaS Alerts: detection, profiling and containment
Kaseya presents INKY as a GenAI-driven email analysis tool that complements conventional email security by adding language and behavioural understanding. INKY uses advanced sender profiling, stylometry and machine learning to spot inconsistencies between an account’s historical writing patterns and subtle deviations in a suspect message. It builds and maintains detailed profiles of trusted senders—technical and behavioural fingerprints—that help it flag third-party emails that do not match established norms.
When INKY detects a hijack, it does more than tag a message. The system isolates the compromised user, blocks outbound mail, and streams real-time email security telemetry into Kaseya’s SaaS Alerts platform. SaaS Alerts then receives events—such as inbound analysis results, user-reported phishing activity and outbound protection events—and can lock down that user's access across connected SaaS applications. “It means if we see suspicious mail going out, we can shut the account down, and take other remedial actions,” Baggett says. The coupling of inbox analysis with cross-application response is presented as a way to prevent lateral spread through cloud storage, collaboration tools and other identity-driven endpoints.
How MSPs, enterprise security teams, and customers are affected
Managed Service Providers (MSPs) and IT departments: MSPs holding multiple client environments are singled out as particularly exposed; many small and mid-sized customers lack in-house security expertise and rely on MSPs to detect sophisticated account-takeover techniques. The INKY–SaaS Alerts integration is pitched as an MSP-friendly automation that can scale detection and containment across many tenants.
Enterprise procurement and security teams: The piece emphasizes integration over point solutions. Procurement and security leaders should expect tools that publish and subscribe to a shared event stream—so that email telemetry, SaaS access logs and automated response actions can coordinate in real time.
Customers, suppliers and end users: Recipients of email—especially those used to receiving messages from trusted partners or senior executives—remain the most exposed. Outbound phishing launched from a hijacked third party can reach customers and suppliers who have no visibility into the third party’s protections.
Trade-offs, integration and the road ahead
Baggett cautions that defenders cannot simply route every message through a large language model: “You can’t just put every inbound and outbound mail through an LLM since the economics don’t add up.” The proposed response is selective, intelligence-driven processing plus deeper integration of security components. Kaseya describes steps toward a unified data layer where components can publish events in real time and subscribe to others’ signals. The company also says it is building a centralized capability for AI and operates a service bureau of machine learning experts to craft customized models.
The underlying premise is straightforward: account takeover is evolving from blunt, noisy abuse of accounts into a stealthy, conversation-aware intrusion that exploits trust as much as credentials. Kaseya’s solution roadmap—profiling, real-time telemetry sharing and automated cross-application lockdowns—reflects a belief that detection must be married to rapid containment if damage is to be limited.
