Detecting Vendor Compromise and Trusted Relationship Abuse with Darktrace

Vendor Email Compromise refers to attackers breaching a third‑party provider to exploit their access and trusted relationships for malicious purposes, often targeting a company’s existing partners or others it would normally trust. The Darktrace blog notes that phishing from compromised vendors blends supply‑chain and business email compromise techniques, with attackers infiltrating existing conversations and even using AI to mimic tone and avoid spelling mistakes.

The piece describes how Darktrace detected four different vendor compromise campaigns for a single customer over a two‑week period in 2025, using anomaly detection to identify subtle indicators in emails that appeared legitimate. In some instances the emails originated from compromised mailboxes and were sent from known correspondents, with links hosted on legitimate file‑sharing sites or via services like ClickFunnels, designed to redirect to fake Microsoft login pages.

In one case Darktrace / EMAIL could have acted autonomously if fully enabled, while in another it held the offending emails to prevent delivery, illustrating how real‑time detection can disrupt attacks before they reach inboxes, according to Darktrace.