Vertical Privilege Escalation Through Social Engineering?

I was wondering if you can gain vertical privilege escalation through methods of social engineering such as trojan email attacks. For example, attacker attacks simple employee with low data access, then uses the simple employees data to access his email and send a trojan email to someone with more data access. Is this possible?

cybersecurity engineering escalation privilege privilege escalation social social engineering