# Detecting and Characterizing Lateral Phishing at Scale

arXiv: https://arxiv.org/abs/1910.00790 · HTML: https://mlsanity.com/paper/1910.00790/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Oct 2019.

## Built on by (most cited first, 21 of 21)

- [Unsolved Problems in ML Safety](https://mlsanity.com/paper/2109.13916/) (2021)
- [From Chatbots to PhishBots? -- Preventing Phishing scams created using ChatGPT, Google Bard and Claude](https://mlsanity.com/paper/2310.19181/) (2023)
- [Lateral Phishing With Large Language Models: A Large Organization Comparative Study](https://mlsanity.com/paper/2401.09727/) (2024)
- [Phishing URL Detection: A Network-based Approach Robust to Evasion](https://mlsanity.com/paper/2209.01454/) (2022)
- [Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning](https://mlsanity.com/paper/2210.13660/) (2022)
- [RAIDER: Reinforcement-aided Spear Phishing Detector](https://mlsanity.com/paper/2105.07582/) (2021)
- [PhishSim: Aiding Phishing Website Detection with a Feature-Free Tool](https://mlsanity.com/paper/2207.10801/) (2022)
- [LLMs unlock new paths to monetizing exploits](https://mlsanity.com/paper/2505.11449/) (2025)
- [On the Feasibility of Using MultiModal LLMs to Execute AR Social Engineering Attacks](https://mlsanity.com/paper/2504.13209/) (2025)
- [SEAR: A Multimodal Dataset for Analyzing AR-LLM-Driven Social Engineering Behaviors](https://mlsanity.com/paper/2505.24458/) (2025)
- [Profiler: Profile-Based Model to Detect Phishing Emails](https://mlsanity.com/paper/2208.08745/) (2022)
- [Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning](https://mlsanity.com/paper/2302.02031/) (2023)
- [A Modular and Adaptive System for Business Email Compromise Detection](https://mlsanity.com/paper/2308.10776/) (2023)
- [PiMRef: Deducing Ever-evolving Spear-phishing Emails with Knowledge Base Invariants](https://mlsanity.com/paper/2507.15393/) (2025)
- [Holmes: An Efficient and Lightweight Semantic Based Anomalous Email Detector](https://mlsanity.com/paper/2104.08044/) (2021)
- [Classification of Web Phishing Kits for early detection by platform providers](https://mlsanity.com/paper/2210.08273/) (2022)
- [Taming Data Challenges in ML-based Security Tasks Using Generative AI](https://mlsanity.com/paper/2507.06092/) (2025)
- [Per-sender neural network classifiers for email authorship validation](https://mlsanity.com/paper/2509.00005/) (2025)
- ["Are You Sure?": An Empirical Study of Human Perception Vulnerability in LLM-Driven Agentic Systems](https://mlsanity.com/paper/2602.21127/) (2026)
- [Can LLM Agents Simulate Dynamic Networks? A Case Study on Email Networks with Phishing Synthesis](https://mlsanity.com/paper/2605.12507/) (2026)
- [The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs](https://mlsanity.com/paper/2610.03124/) (2026)

## Abstract (arXiv)

We present the first large-scale characterization of lateral phishing attacks, based on a dataset of 113 million employee-sent emails from 92 enterprise organizations. In a lateral phishing attack, adversaries leverage a compromised enterprise account to send phishing emails to other users, benefitting from both the implicit trust and the information in the hijacked user's account. We develop a classifier that finds hundreds of real-world lateral phishing emails, while generating under four false positives per every one-million employee-sent emails. Drawing on the attacks we detect, as well as a corpus of user-reported incidents, we quantify the scale of lateral phishing, identify several thematic content and recipient targeting strategies that attackers follow, illuminate two types of sophisticated behaviors that attackers exhibit, and estimate the success rate of these attacks. Collectively, these results expand our mental models of the 'enterprise attacker' and shed light on the current state of enterprise phishing attacks.