An unsettling cybersecurity breach has emerged as attackers successfully exploited Microsoft 365, bypassing multi-factor authentication (MFA) to redirect vendor payments. A single phishing email granted the hackers access to a finance employee’s account, allowing them to manipulate financial transactions without the need for malware or device infiltration.
Phishing Tactics Undermine Security
The breach began with a deceptive email themed around human resources, falsely stating that a paid-time-off request was denied. This personalized approach employed the employee’s specific details, making it appear more credible than typical mass phishing attempts. The email contained a link leading to a fraudulent Microsoft 365 login page, cleverly designed to capture authenticated sessions.
TrendAI analysts labeled this as a cloud-centered business email compromise operation. The attackers leveraged stolen browser session data and precise timing in their communications to reroute payments to their accounts. Notably, no traditional malware was used; instead, the focus was on exploiting authenticated browser sessions.
Session Hijacking Techniques
Key to the intrusion was the capture of an authenticated session cookie, allowing attackers to replay the session from VPN infrastructure, appearing as the legitimate employee. This method highlights a growing trend in session theft over mere password collection, as seen in other recent phishing campaigns targeting corporate users.
Investigators observed unusual login patterns, including geographically impossible sign-ins from Amsterdam and Los Angeles within a minute. Microsoft 365 logs showed satisfied MFA conditions with no failed login attempts, indicating the session replay attack.
Financial Manipulation and Mitigation
Through the compromised account, attackers accessed Exchange Online and other Microsoft 365 services, infiltrating a shared accounts-payable mailbox. Over 30 days, they impersonated vendors and employees, altering payment details to divert funds. They maintained email threads and created rules to hide fraudulent activities.
To counter such threats, organizations are advised to investigate unusual login activities, employ token protection, and enforce dual verification methods before altering payment instructions. Implementing phishing-resistant authentication can further mitigate risks associated with MFA bypass techniques.
Preventive Measures and Future Outlook
The incident underscores the need for heightened vigilance against identity-focused cyberattacks. Companies must enhance their security protocols, particularly in monitoring impossible travel alerts and unauthorized mailbox rule changes. By adopting comprehensive threat intelligence and reinforcing authentication procedures, businesses can better safeguard against sophisticated phishing schemes.
