huntress.comarticleWhy BEC Is Now an Identity Problem
Huntress breaks down how modern business email compromise (BEC) campaigns in Google Workspace have evolved from simple invoice fraud into multi-stage identity abuse: attackers use OAuth token theft, password-reset/MFA emails, and mailbox filters to hide alerts, persist via forwarding rules, and pivot laterally into other SaaS platforms. The piece argues traditional content-based email detection misses these campaigns and that defenders need identity-centric monitoring (token lifecycle, OAuth consent anomalies, mailbox config changes) — framing this as the rationale for Huntress's expansion of managed identity threat detection (ITDR) into Google Workspace.
TL;DR Huntress explains why detecting modern BEC in Google Workspace requires identity-focused monitoring (OAuth, mailbox rules, token persistence) instead of content-based email filtering.
Technologies named here
- Google Workspace
- Huntress managed detection and response
- Identity Threat Detection and Response
- Gmail
- Microsoft environments
- OAuth
- Huntress
Techniques named here
- Discovery
- Stealth via mailbox filter manipulation
- Lateral SaaS movement via Gmail
- Outbound phishing abuse using trusted identity
- Persistence via forwarding rules and OAuth tokens
Related in Identity & Access
huntress.comarticleEducation Under Attack: The Pattern Behind Recent University Breaches
huntress.comarticleNext-Gen Phishing Tactics Users Aren’t Ready For | Huntress
.png)
aikido.devwriteupGoogle API keys keep working after you delete them
