Email security: real-world exploits, and how our TitanHQ stack shuts them down

Invoice redirection (business email compromise). An attacker gets into one mailbox, sits quietly reading, then emails your finance contact from the genuine account with 'updated bank details' at exactly the right point in a real payment cycle. UK losses to this pattern run into hundreds of millions a year, and because the email is authentic, nothing about it looks forged.

Conversation hijacking. A reply arrives inside an existing thread you started — same subject line, same signature, quoted history intact — but the link goes somewhere new. This is the most successful pattern we see, because the trust has already been established by you.

MFA-bypass credential harvesting. Adversary-in-the-middle kits such as Evilginx proxy the real Microsoft login page, capture the password and then steal the session cookie after the MFA prompt is satisfied. MFA alone does not stop it; not clicking the link does.

Malicious attachments and macro chains. The classic route that put Emotet and later ransomware into thousands of businesses: a themed invoice or delivery notice, a document that asks you to enable content, then a loader that quietly sells access to a ransomware crew.

Supplier compromise. Your own controls are fine; your supplier's are not. The malicious email genuinely comes from their compromised mailbox, so sender reputation and SPF/DKIM all pass cleanly.

CEO impersonation and payroll fraud. A display name matching a director, a free mail domain, and an urgent request for a same-day transfer or a change of bank details for payroll — usually timed for when the real director is visibly on holiday.

SpamTitan — the gateway. Dual anti-virus engines, sandboxing of attachments, and reputation and heuristic filtering stop the bulk-volume and malware-bearing mail before it reaches Microsoft 365. It also enforces SPF, DKIM and DMARC checks properly, which kills straightforward domain spoofing, and outbound scanning protects your sending reputation if a device does get infected.

PhishTitan — inside the mailbox. This is the layer that catches what a gateway structurally cannot: malware-free phishing, conversation hijacking and links weaponised after delivery. It integrates directly with Microsoft 365, rewrites and time-of-click checks URLs, banners suspicious internal and external mail so the user is warned in context, and lets us remediate a malicious message out of every mailbox it reached.

ArcTitan — the archive. Tamper-proof, encrypted, searchable archiving of every message sent and received. After an incident it tells you exactly who received what and when, which is the difference between a two-hour investigation and a two-week one. It is also the practical answer to GDPR subject access requests and to record-retention obligations.

The layer no product replaces. Process. A rule that bank-detail changes are verified by phone to a previously known number, and that no payment is released on email authority alone, defeats invoice redirection even when the email is perfect. We help clients write that rule and train staff against realistic examples.