Microsoft's security team published a breakdown of a phishing campaign that started the way the bad ones always do: an email from a vendor the firm already trusted, pointing at a shared document.
The sign-in page was fake. What happened next is the part worth your attention.
The attacker didn't smash anything. They created a mailbox rule that deleted incoming mail and marked it read, so the owner never saw the replies. They added their own multifactor method. Then they sent more than 600 phishing emails out of that real mailbox — to clients, colleagues, anyone in a recent thread. When a few people wrote back asking if it was legitimate, the attacker answered and said yes, then deleted the exchange.
Microsoft's guidance on this is blunt: resetting the password alone isn't enough. The stolen session is still valid, and the leftovers are still sitting in the tenant.
That's most of why we run a quarterly tenant review. We're not hunting malware. We're reading mailbox rules, the registered sign-in methods on each account, which outside apps still hold access, and which logins don't fit the pattern.
For a CPA firm heading into filing season, that's an afternoon of checking versus a month of phone calls.
Worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email