One of the most pernicious forms of phishing involves account takeover. In these attacks a bad actor harvests, guesses, or bruteforces the password for an email account, and then uses this account to impersonate a person or brand... often with devastating results. In this report we examine real-world account takeover scenarios, why they are difficult for SEGs to identify, and how INKY catches them using sender profiling and stylometry.