Systems and methods for detecting and mitigating threats in electronic messages

A method comprising:

• receiving via a computing system an electronic message from a first account directed to a second account;
• detecting at least one of a username or a password in the electronic message;
• performing a network search to detect the at least one of the username or the password on a network-accessible datastore;
• and
• providing a notification via the computing system at least based on the detecting the at least one of the username or the password on the network-accessible datastore.

A method comprising:

• receiving a plurality of electronic messages from a first plurality of accounts directed to a second plurality of accounts over a network;
• comparing the plurality of electronic messages to determine a plurality of clusters of electronic messages;
• receiving via a computing system a particular electronic message from a first particular account directed to a second particular account;
• comparing the particular electronic message to the plurality of clusters of electronic messages to determine that the particular electronic message is associated with a particular cluster of the plurality of clusters of electronic messages;
• determining a number of the plurality of electronic messages that exceed a particular threshold level of similarity as compared to the particular electronic message based on the comparing the particular electronic message to the plurality of clusters of electronic messages;
• and
• providing a notification via the computing system based on the determining that the particular electronic message is associated with the particular cluster of the plurality of clusters of electronic messages and based on the number of the plurality of electronic messages that exceed the particular threshold level of similarity as compared to the particular electronic message.

A system, comprising:

• one or more processors;
• and
• memory storing executable instructions that, as a result of being executed, cause the system to perform operations comprising:
• receiving a plurality of electronic messages from a first plurality of accounts directed to a second plurality of accounts over a network;
• comparing the plurality of electronic messages to determine a plurality of clusters of electronic messages;
• receiving a particular electronic message from a first particular account directed to a second particular account;
• comparing the particular electronic message to the plurality of clusters of electronic messages to determine that the particular electronic message is associated with a particular cluster of the plurality of clusters of electronic messages;
• and
• providing a notification at least based on the determining that the particular electronic message is associated with the particular cluster of the plurality of clusters of electronic messages.

A non-transitory computer-readable storage medium storing executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to:

• receive a plurality of electronic messages from a first plurality of accounts directed to a second plurality of accounts over a network;
• compare the plurality of electronic messages to determine a plurality of clusters of electronic messages;
• receive a particular electronic message from a first particular account directed to a second particular account;
• compare the particular electronic message to the plurality of clusters of electronic messages to determine that the particular electronic message is associated with a particular cluster of the plurality of clusters of electronic messages;
• and
• provide a notification at least based on the determining that the particular electronic message is associated with the particular cluster of the plurality of clusters of electronic messages.