In the realm of enterprise phishing, impersonation tactics targeting customers and vendors have become some of the most effective vectors for attackers. These tactics exploit the trust that enterprises place in their external relationships, creating a gateway for attackers to infiltrate systems, steal sensitive information, and cause widespread damage. Here’s how customers and vendors are used as phishing vectors:

• Customer Impersonation: Attackers often pose as trusted customers to trick employees into divulging sensitive information or granting unauthorized access. For example, an attacker might send a phishing email from what appears to be a high-value customer account, requesting changes to billing information or asking for internal documents. Employees, eager to assist important customers, may bypass standard security checks, allowing the attacker to gain access.
• Vendor Spoofing: Phishers impersonate vendors or suppliers with whom the enterprise has an established relationship. Attackers send phishing emails that appear to come from legitimate vendor domains, often including accurate details about ongoing projects or orders. These emails typically request payment changes, updated bank details, or direct deposits, which, if followed, can result in significant financial losses.
• Business Email Compromise (BEC): In BEC attacks, phishers impersonate high-level executives or important external partners to trick employees into performing fraudulent actions, such as transferring funds or sharing confidential data. These highly targeted attacks rely on impersonating individuals with the authority to bypass typical security protocols, often using urgent language to pressure employees into immediate action.
• Vendor Account Takeovers: Attackers may infiltrate a vendor’s email account and send phishing emails from their legitimate email address. Since the emails are sent from a trusted source, enterprise employees are more likely to follow instructions without suspicion. The phisher may request updated payment information, access to enterprise systems, or changes to critical vendor settings, leading to unauthorized access or financial fraud.
• Fake Vendor Onboarding: Phishers create fake vendor profiles and approach enterprises as new potential suppliers. These imposters initiate contracts or negotiations, sending phishing emails that ask for sensitive business details, billing information, or secure login credentials. Once the attacker gains access, they may exfiltrate data or exploit financial vulnerabilities.
• Customer Phishing Portals: Phishers may set up fake customer support portals that closely resemble legitimate enterprise platforms. Customers are tricked into entering their credentials or payment information, which is then harvested and used to gain access to their accounts. From there, attackers can escalate their attack to compromise enterprise systems by impersonating the customer and requesting account or service changes.
• Supply Chain Compromise: Phishers may target the enterprise’s supply chain, using phishing emails to compromise smaller vendors or service providers. Once a vendor is compromised, attackers use the vendor’s email accounts or systems to launch phishing attacks against the enterprise. This often occurs without detection, as emails from a legitimate vendor are considered trustworthy.
• Compromised Vendor Invoices: Attackers often exploit existing relationships by sending fraudulent invoices that appear to come from trusted vendors. These phishing emails may include cloned invoice templates or real information obtained through a prior compromise, making it difficult for employees to spot the fake. Payment is then redirected to the attacker’s bank account, leading to financial loss.
• Vendor Impersonation in Contract Renewals: Phishers pose as vendors during contract renewal periods, sending phishing emails that request contract updates, payment processing changes, or document approvals. The legitimate nature of contract renewals, combined with the timing of the email, increases the likelihood of employees complying with the phisher’s requests without realizing the attack.
• Impersonation via Third-Party Platforms: Phishers may impersonate customers or vendors on third-party platforms such as LinkedIn or Slack. They may send phishing links or fraudulent requests through these channels, targeting enterprise employees who assume the communication is legitimate because it appears to come from a trusted connection.

Enterprises must remain vigilant when dealing with both customers and vendors, as attackers continue to find new ways to impersonate trusted individuals and organizations. Security measures such as email verification, multi-factor authentication, and vendor management protocols are essential to defending against these threats.