Email Account Compromise is a sophisticated email scam in which threat actors utilize social engineering tactics designed to manipulate psychology or computer intrusion techniques to compromise an email account without the knowledge of the account owner or the victims receiving fraudulent emails from this compromised account. These exploits are typically initiated with a phishing email, where a user gets his or her email account compromised by clicking on a link, opening an attachment or having his or her account “brute-forced” - a scenario in which the intruder otherwise figures out the account owner’s email login password and tricks the account owner into giving up credentials. Once an email account is compromised, it’s game on for the attacker - who now has full access to the account. Malicious spam emails are often sent out to everyone in the account owner’s address book, leveraging the trust that the account owner has built with these contacts to compromise further accounts with the same deceptive techniques. Sometimes threat actors will spread out these fraudulent emails in an effort to “fly under the radar” for a longer period of time. The proliferation of cloud platforms like Microsoft 365 and Google Workspace for business email has made EAC even more efficient and dangerous, as cyber thieves are able to open any account, test their methods until they are able to bypass default filters, and reuse these methods in attacks targeting thousands of different accounts. EAC attacks are extremely difficult to detect and combat. In these dangerous campaigns, malicious emails are often sent directly from the compromised account owner’s computer, which has been authorized to send mail as that user. In these cases, fraudulent emails are not identified and flagged by any sender authentication protocols that the account owner has implemented because they aren’t violating any of the SPF, DKIM or DMARC rules in place. As a result, malicious emails sent in these scams “pass the test” and are delivered to victims’ inboxes where they can cause serious harm - often leading to fraudulent wire transfers.