System and method for email account takeover detection and remediation

A system to support electronic message account takeover detection and monitoring, comprising:

• an artificial intelligence (AI) engine running on a host, which in operation, is configured to
• collect an electronic message sent from an electronic message account of a user in an entity to another user in the entity automatically in real time via an application programming interface (API) call to an electronic messaging system of the entity;
• compute and maintain in a database statistics on popularity of domains across the internet;
• analyze the collected electronic message to extract a plurality of features and/or signals from the electronic message to determine if the electronic message is malicious for electronic message account takeover detection;
• determine if the electronic message account has been compromised by an electronic message account takeover attack based on one or more of the plurality of extracted features and/or signals in the electronic message including popularity of a domain in the electronic message;
• notify a user, one or more intended recipients of the electronic message and/or an administrator of the electronic messaging system of the electronic message account takeover attack;
• continuously monitor in real time electronic messages sent from the electronic message account that has been compromised by the electronic message account takeover attack.