Member-only story
Email Analysis & Investigation 📧
How Analysts Break Down Suspicious Emails in Modern Attacks
4 min readMar 6, 2026
Email Investigation Series
This series explores how analysts investigate phishing, business email compromise, and modern email-based identity attacks.
Why email investigations still matter in 2026 🔎
Most modern compromises don’t start with malware. They start with a message that looks normal enough to trust.
Email is the “entry layer” for:
- credential phishing (including AiTM)
- OAuth consent abuse
- QR phishing
- BEC and conversation hijacking
- internal phishing from compromised accounts
The goal of email analysis isn’t to “prove it’s bad” from one artifact. It’s to reconstruct what happened and what risk followed.
The investigation mindset 🧠
Before opening tools, anchor your investigation with 3 questions:
- What did the user do? (clicked, replied, downloaded, approved consent, entered creds)
- What changed after the email? (new sign-in, OAuth grant, mailbox rule, forwarding, new inbox access)
- What’s the blast radius? (only one mailbox? multiple recipients? internal spread?)
